diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2019-06-02 23:35:04 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2019-06-02 23:35:03 -0700 |
| commit | 16819b1724ca924e698aea615ea72fc50c4174e6 (patch) | |
| tree | 9120f75a4a6bdfa5df08e8c358e898f292528a08 /drivers/char | |
| parent | 77b2a51180290d8417679f03b1a3c2c266149741 (diff) | |
| parent | cfef4f88308a986d1a02bb51a6b6de709c4a75a7 (diff) | |
Merge "diag: Prevent out-of-bound access while processing mask commands"
Diffstat (limited to 'drivers/char')
| -rw-r--r-- | drivers/char/diag/diag_masks.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/drivers/char/diag/diag_masks.c b/drivers/char/diag/diag_masks.c index 04d827de8570..5372f1235f30 100644 --- a/drivers/char/diag/diag_masks.c +++ b/drivers/char/diag/diag_masks.c @@ -2270,6 +2270,8 @@ int diag_process_apps_masks(unsigned char *buf, int len, int pid) return -EINVAL; if (*buf == DIAG_CMD_LOG_CONFIG) { + if (len < (2 * sizeof(int))) + return -EINVAL; sub_cmd = *(int *)(buf + sizeof(int)); switch (sub_cmd) { case DIAG_CMD_OP_LOG_DISABLE: @@ -2286,6 +2288,8 @@ int diag_process_apps_masks(unsigned char *buf, int len, int pid) break; } } else if (*buf == DIAG_CMD_MSG_CONFIG) { + if (len < (2 * sizeof(uint8_t))) + return -EINVAL; sub_cmd = *(uint8_t *)(buf + sizeof(uint8_t)); switch (sub_cmd) { case DIAG_CMD_OP_GET_SSID_RANGE: |