From 94cda67dae777bcb3dd581e26dd40763fae4f8a2 Mon Sep 17 00:00:00 2001 From: Sreelakshmi Gownipalli Date: Mon, 29 Jan 2018 13:17:13 -0800 Subject: diag: Add conditional check for len in dci_process_ctrl_status() Add correct conditional check for len in dci_process_ctrl_status() to prevent buffer overflow. Change-Id: Id73ed1c8b104428eceef0544ce2858160cc08fd2 Signed-off-by: Sreelakshmi Gownipalli --- drivers/char/diag/diag_dci.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/drivers/char/diag/diag_dci.c b/drivers/char/diag/diag_dci.c index 6b8b00809cd3..9a98b0124713 100644 --- a/drivers/char/diag/diag_dci.c +++ b/drivers/char/diag/diag_dci.c @@ -863,7 +863,7 @@ static void dci_process_ctrl_status(unsigned char *buf, int len, int token) read_len += sizeof(struct diag_ctrl_dci_status); for (i = 0; i < header->count; i++) { - if (read_len > len) { + if (read_len > (len - 2)) { pr_err("diag: In %s, Invalid length len: %d\n", __func__, len); return; -- cgit v1.2.3