diff options
| author | Anand Kumar <anandkumar@codeaurora.org> | 2016-06-21 17:36:05 +0530 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2016-07-20 00:35:18 -0700 |
| commit | f009a48f80da5bcc9572bb381f214d3c77fc6c93 (patch) | |
| tree | c3d34a98113907d3803e187f3970c5e34838af5d | |
| parent | 7eb20e5733b82473d2d1e9e59aa42989e73f3c70 (diff) | |
wcnss: Avoid user buffer overloading for write cal data
compare size of allocated cal data buffer from heap
and count bytes provided to write by user to avoid
heap overflow for write cal data.
Change-Id: Id70c3230f761385489e5e94c613f4519239dfb1f
CRs-Fixed: 1032174
Signed-off-by: Anand Kumar <anandkumar@codeaurora.org>
| -rw-r--r-- | drivers/net/wireless/wcnss/wcnss_wlan.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/net/wireless/wcnss/wcnss_wlan.c b/drivers/net/wireless/wcnss/wcnss_wlan.c index 86f3a4800d1d..3f9eeabc5464 100644 --- a/drivers/net/wireless/wcnss/wcnss_wlan.c +++ b/drivers/net/wireless/wcnss/wcnss_wlan.c @@ -3339,7 +3339,7 @@ static ssize_t wcnss_wlan_write(struct file *fp, const char __user return -EFAULT; if ((UINT32_MAX - count < penv->user_cal_rcvd) || - MAX_CALIBRATED_DATA_SIZE < count + penv->user_cal_rcvd) { + (penv->user_cal_exp_size < count + penv->user_cal_rcvd)) { pr_err(DEVICE " invalid size to write %zu\n", count + penv->user_cal_rcvd); rc = -ENOMEM; |