commit 445d59d864e1d89ce24c3de42be71c98d447d2b6
author Linux Build Service Account <lnxbuild@localhost> Wed Jan 04 11:09:34 2012 -0800
committer QuIC Gerrit Code Review <code-review@localhost> Wed Jan 04 11:09:34 2012 -0800
tree 34a1c7f9d84dccd2cb9aaafa3515d9488859a42c
parent 3c43781d7552afc71809a71e1ad22570a1820f33
parent 1fedab9bed911643d42daecce52d73865e6492a2

Merge "diag: Prevent crash due to buffer over run" into msm-3.0

drivers/char/diag/diagfwd.c

diff --git a/drivers/char/diag/diagfwd.c b/drivers/char/diag/diagfwd.c
index 74d2d71..d7191c8 100644
--- a/drivers/char/diag/diagfwd.c
+++ b/drivers/char/diag/diagfwd.c
@@ -903,6 +903,11 @@
 void diag_send_error_rsp(int index)
 {
 	int i;
+
+	if (index > 490) {
+		pr_err("diag: error response too huge, aborting\n");
+		return;
+	}
 	driver->apps_rsp_buf[0] = 0x13; /* error code 13 */
 	for (i = 0; i < index; i++)
 		driver->apps_rsp_buf[i+1] = *(driver->hdlc_buf+i);