From 929ae03f6f301eeda8e8b2db2061c0019a0e735e Mon Sep 17 00:00:00 2001
From: Sreelakshmi Gownipalli <sgownipa@codeaurora.org>
Date: Mon, 29 Jan 2018 13:17:13 -0800
Subject: [PATCH] diag: Add conditional check for len in
dci_process_ctrl_status()
Add correct conditional check for len in dci_process_ctrl_status() to
prevent buffer overflow.
Change-Id: Id73ed1c8b104428eceef0544ce2858160cc08fd2
Signed-off-by: Sreelakshmi Gownipalli <sgownipa@codeaurora.org>
---
drivers/char/diag/diag_dci.c | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/char/diag/diag_dci.c b/drivers/char/diag/diag_dci.c
index 42b8abfc2c89..79b59a50bc25 100644
--- a/drivers/char/diag/diag_dci.c
+++ b/drivers/char/diag/diag_dci.c
@@ -828,7 +828,7 @@ static void dci_process_ctrl_status(unsigned char *buf, int len, int token)
read_len += sizeof(struct diag_ctrl_dci_status);
for (i = 0; i < header->count; i++) {
- if (read_len > len) {
+ if (read_len > (len - 2)) {
pr_err("diag: In %s, Invalid length len: %d\n",
__func__, len);
return;
--
GitLab