diff options
| author | Mohammed Javid <mjavid@codeaurora.org> | 2018-01-19 18:56:51 +0530 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2018-02-07 22:49:47 -0800 |
| commit | 36737be7c69ff3408868592f76afcfd9945864dc (patch) | |
| tree | d8406ab71cbc5d7c39e4749d3a12cf51814ad973 /drivers/platform | |
| parent | f0020b57b545e3cbd39fef9d6676e48a6c73b95f (diff) | |
msm: ipa: Fix to add string NULL terminator
Missing null terminator to userspcae provided
string leads to strlen buffer overflow in strlcpy function.
Added code changes to fix string NULL terminator issue.
Change-Id: I3f9d5f22fbb26f68de12370bc5e07a4e6bc2ced9
Acked-by: Ashok Vuyyuru <avuyyuru@qti.qualcomm.com>
Signed-off-by: Mohammed Javid <mjavid@codeaurora.org>
Diffstat (limited to 'drivers/platform')
| -rw-r--r-- | drivers/platform/msm/ipa/ipa_v2/rmnet_ipa.c | 1 | ||||
| -rw-r--r-- | drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c | 1 |
2 files changed, 2 insertions, 0 deletions
diff --git a/drivers/platform/msm/ipa/ipa_v2/rmnet_ipa.c b/drivers/platform/msm/ipa/ipa_v2/rmnet_ipa.c index a4963f918ae0..6abcd0ad7cf4 100644 --- a/drivers/platform/msm/ipa/ipa_v2/rmnet_ipa.c +++ b/drivers/platform/msm/ipa/ipa_v2/rmnet_ipa.c @@ -1660,6 +1660,7 @@ static int ipa_wwan_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) IPAWANERR("Failed to allocate memory.\n"); return -ENOMEM; } + extend_ioctl_data.u.if_name[IFNAMSIZ-1] = '\0'; len = sizeof(wan_msg->upstream_ifname) > sizeof(extend_ioctl_data.u.if_name) ? sizeof(extend_ioctl_data.u.if_name) : diff --git a/drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c b/drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c index 9b178fccd1f8..9f65da651cf9 100644 --- a/drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c +++ b/drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c @@ -1741,6 +1741,7 @@ static int ipa3_wwan_ioctl(struct net_device *dev, struct ifreq *ifr, int cmd) IPAWANERR("Failed to allocate memory.\n"); return -ENOMEM; } + extend_ioctl_data.u.if_name[IFNAMSIZ-1] = '\0'; len = sizeof(wan_msg->upstream_ifname) > sizeof(extend_ioctl_data.u.if_name) ? sizeof(extend_ioctl_data.u.if_name) : |