diff options
| author | Sreelakshmi Gownipalli <sgownipa@codeaurora.org> | 2018-01-29 13:17:13 -0800 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2018-03-01 11:07:39 -0800 |
| commit | 94cda67dae777bcb3dd581e26dd40763fae4f8a2 (patch) | |
| tree | 044165f08ad08951a2ffa7be14fbc60fac1f16f8 | |
| parent | 07ec991ea1a1f719aca6d5c4f11c8df4bf02d5c9 (diff) | |
diag: Add conditional check for len in dci_process_ctrl_status()
Add correct conditional check for len in dci_process_ctrl_status() to
prevent buffer overflow.
Change-Id: Id73ed1c8b104428eceef0544ce2858160cc08fd2
Signed-off-by: Sreelakshmi Gownipalli <sgownipa@codeaurora.org>
| -rw-r--r-- | drivers/char/diag/diag_dci.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/char/diag/diag_dci.c b/drivers/char/diag/diag_dci.c index 6b8b00809cd3..9a98b0124713 100644 --- a/drivers/char/diag/diag_dci.c +++ b/drivers/char/diag/diag_dci.c @@ -863,7 +863,7 @@ static void dci_process_ctrl_status(unsigned char *buf, int len, int token) read_len += sizeof(struct diag_ctrl_dci_status); for (i = 0; i < header->count; i++) { - if (read_len > len) { + if (read_len > (len - 2)) { pr_err("diag: In %s, Invalid length len: %d\n", __func__, len); return; |