Преглед на файлове

msm: ipa: Add change to fix out of bound access issue

Non null terminated string from user space can cause out
of bound access issue. Hence added a NULL character
explicitly in dev name when received from user space.

Change-Id: I66f6bce93434757c98f6dcd577f547210c1a4169
Signed-off-by: Armaan Siddiqui <[email protected]>
Armaan Siddiqui преди 3 години
родител
ревизия
c4b267ea87
променени са 1 файла, в които са добавени 2 реда и са изтрити 1 реда
  1. 2 1
      drivers/platform/msm/ipa/ipa_v3/ipa.c

+ 2 - 1
drivers/platform/msm/ipa/ipa_v3/ipa.c

@@ -918,7 +918,8 @@ static int ipa3_send_pdn_config_msg(unsigned long usr_param)
 	buff = pdn_info;
 
 	msg_meta.msg_type = pdn_info->pdn_cfg_type;
-
+	/* null terminate the string */
+	pdn_info->dev_name[IPA_RESOURCE_NAME_MAX - 1] = '\0';
 	if ((pdn_info->pdn_cfg_type < IPA_PDN_DEFAULT_MODE_CONFIG) ||
 			(pdn_info->pdn_cfg_type >= IPA_PDN_CONFIG_EVENT_MAX)) {
 		IPAERR_RL("invalid pdn_cfg_type =%d", pdn_info->pdn_cfg_type);