diff options
| author | Deepak Kumar Singh <deesin@codeaurora.org> | 2019-03-05 17:16:54 +0530 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2019-03-05 03:51:54 -0800 |
| commit | caf53b2661cf5a9863048b7af89bd89a8ad0d282 (patch) | |
| tree | 1bbc0cfb71521273c09b29417380c178c83eca44 /lib/qmi_encdec.c | |
| parent | 733f5a1d1d7d47068181a551f362dab2f5f1dc4b (diff) | |
soc: qcom: qmi_encdec: Restrict string length in decode
The QMI TLV value for strings in a lot of qmi element info structures
account for null terminated strings with MAX_LEN + 1. If a string is
actually MAX_LEN + 1 length, this will cause an out of bounds access
when the NULL character is appended in decoding.
CR-Fixed: 2359244
Change-Id: I4d789bc6017ff58458f77fe875ca4e175a4f1357
Signed-off-by: Chris Lew <clew@codeaurora.org>
Signed-off-by: Deepak Kumar Singh <deesin@codeaurora.org>
Diffstat (limited to 'lib/qmi_encdec.c')
| -rw-r--r-- | lib/qmi_encdec.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/lib/qmi_encdec.c b/lib/qmi_encdec.c index 72b506bececc..9d5c446830ed 100644 --- a/lib/qmi_encdec.c +++ b/lib/qmi_encdec.c @@ -1,4 +1,4 @@ -/* Copyright (c) 2012-2015, The Linux Foundation. All rights reserved. +/* Copyright (c) 2012-2015, 2019 The Linux Foundation. All rights reserved. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License version 2 and @@ -710,8 +710,8 @@ static int qmi_decode_string_elem(struct elem_info *ei_array, void *buf_dst, decoded_bytes += rc; } - if (string_len > temp_ei->elem_len) { - pr_err("%s: String len %d > Max Len %d\n", + if (string_len >= temp_ei->elem_len) { + pr_err("%s: String len %d >= Max Len %d\n", __func__, string_len, temp_ei->elem_len); return -ETOOSMALL; } else if (string_len > tlv_len) { |