A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-05 19:31:57 -04:00
Code Issues Projects Releases Packages Wiki Activity

bus: mhi: Fix potential out-of-bound access

Browse source 
In mhi_sat_isvalid_header function if the length is less than
the size of header then there can be out-of-bound access.

So fix the len check in the function.

Change-Id: I80f1556557b1bf2f30c07f6377bd6e3db48712b3
Signed-off-by: Krishna chaitanya chundru <quic_krichai@quicinc.com>
(cherry picked from commit d7601393dc)
This commit is contained in:
Krishna chaitanya chundru 2023-06-16 10:27:03 +05:30 • committed by Surapusetty Naresh Babu
commit 6df00291cb
1 changed files with 2 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
drivers/bus/mhi/devices/mhi_satellite.c
View file

@ -357,7 +357,8 @@ static struct mhi_sat_device *find_sat_dev_by_id(
static bool mhi_sat_isvalid_header(struct sat_header *hdr, int len)
{
/* validate payload size */
if (len >= sizeof(*hdr) && (len != hdr->payload_size + sizeof(*hdr)))
if ((len < sizeof(*hdr)) ||
(len >= sizeof(*hdr) && (len != hdr->payload_size + sizeof(*hdr))))
return false;
/* validate SAT IPC version */