msm: ipa: prevent string buffer overflows in IPA driver
In IPA ioctls user-supplied data structures
contain string members,but there's no guarantee
they're null-terminated, add the string terminator
to prevent vulnerability of string buffer overflows
Change-Id: If79481d03201f405e5d95a525c8e69220d58a45f
Acked-by: Ashok Vuyyuru <avuyyuru@qti.qualcomm.com>
Signed-off-by: Mohammed Javid <mjavid@codeaurora.org>
diff --git a/drivers/platform/msm/ipa/ipa_v3/ipa_hdr.c b/drivers/platform/msm/ipa/ipa_v3/ipa_hdr.c
index cc29f8f..34624c0 100644
--- a/drivers/platform/msm/ipa/ipa_v3/ipa_hdr.c
+++ b/drivers/platform/msm/ipa/ipa_v3/ipa_hdr.c
@@ -1133,6 +1133,7 @@
return -EINVAL;
}
mutex_lock(&ipa3_ctx->lock);
+ lookup->name[IPA_RESOURCE_NAME_MAX-1] = '\0';
entry = __ipa_find_hdr(lookup->name);
if (entry) {
lookup->hdl = entry->id;
@@ -1255,6 +1256,7 @@
return -EINVAL;
}
mutex_lock(&ipa3_ctx->lock);
+ copy->name[IPA_RESOURCE_NAME_MAX-1] = '\0';
entry = __ipa_find_hdr(copy->name);
if (entry) {
memcpy(copy->hdr, entry->hdr, entry->hdr_len);