A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-25 14:13:01 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: Fix information leak issue during memcpy

Browse source 
The buffer allocated with length "ATH6KL_FWLOG_PAYLOAD_SIZE"
is not initialized, this may lead to information leak during
memcpy when len < ATH6KL_FWLOG_PAYLOAD_SIZE.

To resolve this issue, memset the buffer for length
(ATH6KL_FWLOG_PAYLOAD_SIZE - len) to 0

Change-Id: If4a49347d674ad2af0438b408a4a4b9308c61026
CRs-Fixed: 2255083
This commit is contained in:
Alok Kumar 2018-06-06 12:53:05 +05:30 • committed by nshrivas
commit e7ac594b6a
1 changed files with 12 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

12
utils/fwlog/dbglog_host.c
View file

@ -1764,6 +1764,12 @@ send_diag_netlink_data(const uint8_t *buffer, uint32_t len, uint32_t cmd)
slot->dropped = get_version;
memcpy(slot->payload, buffer, len);
/*
* Need to pad each record to fixed length
* ATH6KL_FWLOG_PAYLOAD_SIZE
*/
memset(slot->payload + len, 0, ATH6KL_FWLOG_PAYLOAD_SIZE - len);
res = nl_srv_bcast_fw_logs(skb_out);
if ((res < 0) && (res != -ESRCH)) {
AR_DEBUG_PRINTF(ATH_DEBUG_RSVD1,
@ -1824,6 +1830,12 @@ dbglog_process_netlink_data(wmi_unified_t wmi_handle, const uint8_t *buffer,
slot->dropped = cpu_to_le32(dropped);
memcpy(slot->payload, buffer, len);
/*
* Need to pad each record to fixed length
* ATH6KL_FWLOG_PAYLOAD_SIZE
*/
memset(slot->payload + len, 0, ATH6KL_FWLOG_PAYLOAD_SIZE - len);
res = nl_srv_bcast_fw_logs(skb_out);
if ((res < 0) && (res != -ESRCH)) {
AR_DEBUG_PRINTF(ATH_DEBUG_RSVD1,