From 543a8ac5754420a694009025335080278b0bbccf Mon Sep 17 00:00:00 2001 From: Yue Ma Date: Mon, 6 Jan 2020 17:57:33 -0800 Subject: [PATCH] cnss2: NULL terminate FW build ID string If FW build ID passed by QMI from firmware is a non-NULL terminated string, it will result in a out-of-bounds read when driver populates the QMI message using strlcpy where the src string must be NULL terminated. Hence manually NULL terminate the string. Change-Id: I8e27c01eae79e56afd1a706d071b4ccfa51d79e0 Signed-off-by: Yue Ma --- drivers/net/wireless/cnss2/qmi.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/net/wireless/cnss2/qmi.c b/drivers/net/wireless/cnss2/qmi.c index 5086b7e9b0c1..6c0c078beb2b 100644 --- a/drivers/net/wireless/cnss2/qmi.c +++ b/drivers/net/wireless/cnss2/qmi.c @@ -1,5 +1,5 @@ // SPDX-License-Identifier: GPL-2.0-only -/* Copyright (c) 2015-2019, The Linux Foundation. All rights reserved. */ +/* Copyright (c) 2015-2020, The Linux Foundation. All rights reserved. */ #include #include @@ -401,9 +401,11 @@ int cnss_wlfw_tgt_cap_send_sync(struct cnss_plat_data *plat_priv) resp->fw_version_info.fw_build_timestamp, QMI_WLFW_MAX_TIMESTAMP_LEN + 1); } - if (resp->fw_build_id_valid) + if (resp->fw_build_id_valid) { + resp->fw_build_id[QMI_WLFW_MAX_BUILD_ID_LEN] = '\0'; strlcpy(plat_priv->fw_build_id, resp->fw_build_id, QMI_WLFW_MAX_BUILD_ID_LEN + 1); + } if (resp->voltage_mv_valid) { plat_priv->cpr_info.voltage = resp->voltage_mv; cnss_pr_dbg("Voltage for CPR: %dmV\n",