diff options
| author | Linux Build Service Account <lnxbuild@localhost> | 2019-04-24 12:53:43 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2019-04-24 12:53:42 -0700 |
| commit | 3d1854afebdb70d642b6c012a09e32f12b3dbd1f (patch) | |
| tree | 339e1961a383fe12324f2688b2dd98db0b6b3a06 /drivers/char | |
| parent | 57a9ae0f5688414033f189d6ec6cee604e3388af (diff) | |
| parent | ef3ade93af0fb745eaff816e6f1ed42f6360f357 (diff) | |
Merge "diag: Prevent out of bound access while getting build mask"
Diffstat (limited to 'drivers/char')
| -rw-r--r-- | drivers/char/diag/diag_masks.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/drivers/char/diag/diag_masks.c b/drivers/char/diag/diag_masks.c index 438f33d8cadb..04d827de8570 100644 --- a/drivers/char/diag/diag_masks.c +++ b/drivers/char/diag/diag_masks.c @@ -643,7 +643,8 @@ static int diag_cmd_get_build_mask(unsigned char *src_buf, int src_len, struct diag_build_mask_req_t *req = NULL; struct diag_msg_build_mask_t rsp; - if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0) { + if (!src_buf || !dest_buf || src_len <= 0 || dest_len <= 0 || + src_len < sizeof(struct diag_build_mask_req_t)) { pr_err("diag: Invalid input in %s, src_buf: %pK, src_len: %d, dest_buf: %pK, dest_len: %d\n", __func__, src_buf, src_len, dest_buf, dest_len); return -EINVAL; |