qcacmn: Fix information leak issue during memcpy
The buffer allocated with length "ATH6KL_FWLOG_PAYLOAD_SIZE" is not initialized, this may lead to information leak during memcpy when len < ATH6KL_FWLOG_PAYLOAD_SIZE. To resolve this issue, memset the buffer for length (ATH6KL_FWLOG_PAYLOAD_SIZE - len) to 0 Change-Id: If4a49347d674ad2af0438b408a4a4b9308c61026 CRs-Fixed: 2255083
这个提交包含在:
@@ -1764,6 +1764,12 @@ send_diag_netlink_data(const uint8_t *buffer, uint32_t len, uint32_t cmd)
|
||||
slot->dropped = get_version;
|
||||
memcpy(slot->payload, buffer, len);
|
||||
|
||||
/*
|
||||
* Need to pad each record to fixed length
|
||||
* ATH6KL_FWLOG_PAYLOAD_SIZE
|
||||
*/
|
||||
memset(slot->payload + len, 0, ATH6KL_FWLOG_PAYLOAD_SIZE - len);
|
||||
|
||||
res = nl_srv_bcast_fw_logs(skb_out);
|
||||
if ((res < 0) && (res != -ESRCH)) {
|
||||
AR_DEBUG_PRINTF(ATH_DEBUG_RSVD1,
|
||||
@@ -1824,6 +1830,12 @@ dbglog_process_netlink_data(wmi_unified_t wmi_handle, const uint8_t *buffer,
|
||||
slot->dropped = cpu_to_le32(dropped);
|
||||
memcpy(slot->payload, buffer, len);
|
||||
|
||||
/*
|
||||
* Need to pad each record to fixed length
|
||||
* ATH6KL_FWLOG_PAYLOAD_SIZE
|
||||
*/
|
||||
memset(slot->payload + len, 0, ATH6KL_FWLOG_PAYLOAD_SIZE - len);
|
||||
|
||||
res = nl_srv_bcast_fw_logs(skb_out);
|
||||
if ((res < 0) && (res != -ESRCH)) {
|
||||
AR_DEBUG_PRINTF(ATH_DEBUG_RSVD1,
|
||||
|
在新工单中引用
屏蔽一个用户