Эх сурвалжийг харах

msm: ipa: Add change to fix out of bound access issue

Non null terminated string from user space can cause out
of bound access issue. Hence added a NULL character
explicitly in dev name when received from user space.

Change-Id: I66f6bce93434757c98f6dcd577f547210c1a4169
Signed-off-by: Armaan Siddiqui <[email protected]>
Armaan Siddiqui 3 жил өмнө
parent
commit
c4b267ea87

+ 2 - 1
drivers/platform/msm/ipa/ipa_v3/ipa.c

@@ -918,7 +918,8 @@ static int ipa3_send_pdn_config_msg(unsigned long usr_param)
 	buff = pdn_info;
 
 	msg_meta.msg_type = pdn_info->pdn_cfg_type;
-
+	/* null terminate the string */
+	pdn_info->dev_name[IPA_RESOURCE_NAME_MAX - 1] = '\0';
 	if ((pdn_info->pdn_cfg_type < IPA_PDN_DEFAULT_MODE_CONFIG) ||
 			(pdn_info->pdn_cfg_type >= IPA_PDN_CONFIG_EVENT_MAX)) {
 		IPAERR_RL("invalid pdn_cfg_type =%d", pdn_info->pdn_cfg_type);