diag: Add conditional check for len in dci_process_ctrl_status()
Add correct conditional check for len in dci_process_ctrl_status() to
prevent buffer overflow.
Change-Id: Id73ed1c8b104428eceef0544ce2858160cc08fd2
Signed-off-by: Sreelakshmi Gownipalli <sgownipa@codeaurora.org>
diff --git a/drivers/char/diag/diag_dci.c b/drivers/char/diag/diag_dci.c
index 0aad08a..23cf293 100644
--- a/drivers/char/diag/diag_dci.c
+++ b/drivers/char/diag/diag_dci.c
@@ -1,4 +1,4 @@
-/* Copyright (c) 2012-2017, The Linux Foundation. All rights reserved.
+/* Copyright (c) 2012-2018, The Linux Foundation. All rights reserved.
*
* This program is free software; you can redistribute it and/or modify
* it under the terms of the GNU General Public License version 2 and
@@ -865,7 +865,7 @@
read_len += sizeof(struct diag_ctrl_dci_status);
for (i = 0; i < header->count; i++) {
- if (read_len > len) {
+ if (read_len > (len - 2)) {
pr_err("diag: In %s, Invalid length len: %d\n",
__func__, len);
return;