qcacmn: Fix information leak issue during memcpy

The buffer allocated with length "ATH6KL_FWLOG_PAYLOAD_SIZE"
is not initialized, this may lead to information leak during
memcpy when len < ATH6KL_FWLOG_PAYLOAD_SIZE.

To resolve this issue, memset the buffer for length
(ATH6KL_FWLOG_PAYLOAD_SIZE - len) to 0

Change-Id: If4a49347d674ad2af0438b408a4a4b9308c61026
CRs-Fixed: 2255083
这个提交包含在:
Alok Kumar
2018-06-06 12:53:05 +05:30
提交者 nshrivas
父节点 2e9e4260c2
当前提交 e7ac594b6a

查看文件

@@ -1764,6 +1764,12 @@ send_diag_netlink_data(const uint8_t *buffer, uint32_t len, uint32_t cmd)
slot->dropped = get_version;
memcpy(slot->payload, buffer, len);
/*
* Need to pad each record to fixed length
* ATH6KL_FWLOG_PAYLOAD_SIZE
*/
memset(slot->payload + len, 0, ATH6KL_FWLOG_PAYLOAD_SIZE - len);
res = nl_srv_bcast_fw_logs(skb_out);
if ((res < 0) && (res != -ESRCH)) {
AR_DEBUG_PRINTF(ATH_DEBUG_RSVD1,
@@ -1824,6 +1830,12 @@ dbglog_process_netlink_data(wmi_unified_t wmi_handle, const uint8_t *buffer,
slot->dropped = cpu_to_le32(dropped);
memcpy(slot->payload, buffer, len);
/*
* Need to pad each record to fixed length
* ATH6KL_FWLOG_PAYLOAD_SIZE
*/
memset(slot->payload + len, 0, ATH6KL_FWLOG_PAYLOAD_SIZE - len);
res = nl_srv_bcast_fw_logs(skb_out);
if ((res < 0) && (res != -ESRCH)) {
AR_DEBUG_PRINTF(ATH_DEBUG_RSVD1,