diff options
| author | Hardik Arya <harya@codeaurora.org> | 2019-04-18 15:06:47 +0530 |
|---|---|---|
| committer | Hardik Arya <harya@codeaurora.org> | 2019-05-15 11:44:00 +0530 |
| commit | cfef4f88308a986d1a02bb51a6b6de709c4a75a7 (patch) | |
| tree | 4e575fed2b1bd0febcb54f6f1d871a091ef524f9 | |
| parent | 946085b74b1073b8cc921e912cea18aa36d64f3a (diff) | |
diag: Prevent out-of-bound access while processing mask commands
Mask commands are being processed without proper check of buffer
length, which can lead to out of bound access. The patch adds
proper check for buffer length.
Change-Id: I6eb7ad01fb86f0cd0fb32390cfedd518428a64ba
Signed-off-by: Hardik Arya <harya@codeaurora.org>
| -rw-r--r-- | drivers/char/diag/diag_masks.c | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/drivers/char/diag/diag_masks.c b/drivers/char/diag/diag_masks.c index c9af1e7f848a..386664188d48 100644 --- a/drivers/char/diag/diag_masks.c +++ b/drivers/char/diag/diag_masks.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2008-2018, The Linux Foundation. All rights reserved. +/* Copyright (c) 2008-2019, The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -2180,6 +2180,8 @@ int diag_process_apps_masks(unsigned char *buf, int len, int pid) return -EINVAL; if (*buf == DIAG_CMD_LOG_CONFIG) { + if (len < (2 * sizeof(int))) + return -EINVAL; sub_cmd = *(int *)(buf + sizeof(int)); switch (sub_cmd) { case DIAG_CMD_OP_LOG_DISABLE: @@ -2196,6 +2198,8 @@ int diag_process_apps_masks(unsigned char *buf, int len, int pid) break; } } else if (*buf == DIAG_CMD_MSG_CONFIG) { + if (len < (2 * sizeof(uint8_t))) + return -EINVAL; sub_cmd = *(uint8_t *)(buf + sizeof(uint8_t)); switch (sub_cmd) { case DIAG_CMD_OP_GET_SSID_RANGE: |