diff options
| author | Gopikrishna Mogasati <gmogas@codeaurora.org> | 2017-04-20 16:25:20 +0530 |
|---|---|---|
| committer | Gopikrishna Mogasati <gmogas@codeaurora.org> | 2017-04-20 16:52:49 +0530 |
| commit | 51d53940ea70b5af9418aba4028082b86365fa7b (patch) | |
| tree | 17fa7b959e0a7440ad9ab92a91ec47a7c790f922 /drivers/char | |
| parent | 7684fb148e9ba54b73b2a896b75d29a10b70ab25 (diff) | |
diag: Fix to check for command length size
Fix to validate payload length size while forwarding
commands to remote processor.
CRs-Fixed: 2004417
Change-Id: Ia047f7895002409e176eeb9e1ddfef69849636ea
Signed-off-by: Sreelakshmi Gownipalli <sgownipa@codeaurora.org>
Signed-off-by: Gopikrishna Mogasati <gmogas@codeaurora.org>
Diffstat (limited to 'drivers/char')
| -rw-r--r-- | drivers/char/diag/diagchar_core.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/drivers/char/diag/diagchar_core.c b/drivers/char/diag/diagchar_core.c index 4f56696f52e9..c6614c9b38ad 100644 --- a/drivers/char/diag/diagchar_core.c +++ b/drivers/char/diag/diagchar_core.c @@ -985,6 +985,11 @@ static int diag_send_raw_data_remote(int proc, void *buf, int len, hdlc_disabled = driver->hdlc_disabled; if (hdlc_disabled) { payload = *(uint16_t *)(buf + 2); + if (payload > DIAG_MAX_HDLC_BUF_SIZE) { + pr_err("diag: Dropping packet, payload size is %d\n", + payload); + return -EBADMSG; + } driver->hdlc_encode_buf_len = payload; /* * Adding 4 bytes for start (1 byte), version (1 byte) and |