diff options
| author | Sreelakshmi Gownipalli <sgownipa@codeaurora.org> | 2018-01-29 13:17:13 -0800 |
|---|---|---|
| committer | ali_lin <Ali_Lin@compal.com> | 2018-05-28 11:29:12 +0800 |
| commit | 32088d83196266e46dc511df235d324084de78f6 (patch) | |
| tree | ba9946feabf7ef9e885a84388546fda9feaa48e6 | |
| parent | ae8c246dc6395c1bc7907abe400a72609974cf80 (diff) | |
diag: Add conditional check for len in dci_process_ctrl_status()android-wear-8.0.0_r0.32
Add correct conditional check for len in dci_process_ctrl_status() to
prevent buffer overflow.
Change-Id: Id73ed1c8b104428eceef0544ce2858160cc08fd2
Signed-off-by: Sreelakshmi Gownipalli <sgownipa@codeaurora.org>
| -rw-r--r-- | drivers/char/diag/diag_dci.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/char/diag/diag_dci.c b/drivers/char/diag/diag_dci.c index 42b8abfc2c89..79b59a50bc25 100644 --- a/drivers/char/diag/diag_dci.c +++ b/drivers/char/diag/diag_dci.c @@ -828,7 +828,7 @@ static void dci_process_ctrl_status(unsigned char *buf, int len, int token) read_len += sizeof(struct diag_ctrl_dci_status); for (i = 0; i < header->count; i++) { - if (read_len > len) { + if (read_len > (len - 2)) { pr_err("diag: In %s, Invalid length len: %d\n", __func__, len); return; |