From 714e6514c76849b8b67ee4e3cc823b40b97a7f03 Mon Sep 17 00:00:00 2001 From: Dundi Raviteja Date: Tue, 23 Jun 2020 19:08:52 +0530 Subject: [PATCH] wcnss: validate build version response correctly Build version response contains smd_msg_hdr also, so validate build version response length by considering the size of smd_msg_hdr. Change-Id: I538ea8bfd1ab8cab1c128fb3f628ba70f08860be CRs-Fixed: 2716972 Signed-off-by: Dundi Raviteja --- drivers/soc/qcom/wcnss/wcnss_wlan.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/drivers/soc/qcom/wcnss/wcnss_wlan.c b/drivers/soc/qcom/wcnss/wcnss_wlan.c index 5ae9596daab4..0c41f4c61291 100644 --- a/drivers/soc/qcom/wcnss/wcnss_wlan.c +++ b/drivers/soc/qcom/wcnss/wcnss_wlan.c @@ -2291,8 +2291,8 @@ static void wcnss_process_smd_msg(void *buf, int len) break; case WCNSS_BUILD_VER_RSP: - /* ToDo: WCNSS_MAX_BUILD_VER_LEN + sizeof(struct smd_msg_hdr) */ - if (len > WCNSS_MAX_BUILD_VER_LEN) { + if (len > sizeof(struct smd_msg_hdr) + + WCNSS_MAX_BUILD_VER_LEN) { wcnss_log(ERR, "invalid build version:%d\n", len); return;