All of lore.kernel.org
 help / color / mirror / Atom feed
* [PATCH 01/13] qmi: validate TLV length
@ 2024-10-31 22:06 Denis Kenzior
  2024-10-31 22:06 ` [PATCH 02/13] gobi: Clear out service request queue on shutdown Denis Kenzior
                   ` (12 more replies)
  0 siblings, 13 replies; 14+ messages in thread
From: Denis Kenzior @ 2024-10-31 22:06 UTC (permalink / raw)
  To: ofono; +Cc: Denis Kenzior

For qmi_result_get_(u)int[8,16,32], make sure that the length
corresponds to the size of the basic type prior to performing the
memcpy.
---
 drivers/qmimodem/qmi.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/qmimodem/qmi.c b/drivers/qmimodem/qmi.c
index 0ba2e8b9e352..10dbdaac8bf6 100644
--- a/drivers/qmimodem/qmi.c
+++ b/drivers/qmimodem/qmi.c
@@ -2311,7 +2311,7 @@ bool qmi_result_get_uint8(struct qmi_result *result, uint8_t type,
 		return false;
 
 	ptr = tlv_get(result->data, result->length, type, &len);
-	if (!ptr)
+	if (!ptr || len != sizeof(uint8_t))
 		return false;
 
 	if (value)
@@ -2330,7 +2330,7 @@ bool qmi_result_get_int16(struct qmi_result *result, uint8_t type,
 		return false;
 
 	ptr = tlv_get(result->data, result->length, type, &len);
-	if (!ptr)
+	if (!ptr || len != sizeof(int16_t))
 		return false;
 
 	memcpy(&tmp, ptr, 2);
@@ -2351,7 +2351,7 @@ bool qmi_result_get_uint16(struct qmi_result *result, uint8_t type,
 		return false;
 
 	ptr = tlv_get(result->data, result->length, type, &len);
-	if (!ptr)
+	if (!ptr || len != sizeof(uint16_t))
 		return false;
 
 	memcpy(&tmp, ptr, 2);
@@ -2373,7 +2373,7 @@ bool qmi_result_get_uint32(struct qmi_result *result, uint8_t type,
 		return false;
 
 	ptr = tlv_get(result->data, result->length, type, &len);
-	if (!ptr)
+	if (!ptr || len != sizeof(uint32_t))
 		return false;
 
 	memcpy(&tmp, ptr, 4);
@@ -2395,7 +2395,7 @@ bool qmi_result_get_uint64(struct qmi_result *result, uint8_t type,
 		return false;
 
 	ptr = tlv_get(result->data, result->length, type, &len);
-	if (!ptr)
+	if (!ptr || len != sizeof(uint64_t))
 		return false;
 
 	memcpy(&tmp, ptr, 8);
-- 
2.45.2


^ permalink raw reply related	[flat|nested] 14+ messages in thread

end of thread, other threads:[~2024-11-04 22:20 UTC | newest]

Thread overview: 14+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2024-10-31 22:06 [PATCH 01/13] qmi: validate TLV length Denis Kenzior
2024-10-31 22:06 ` [PATCH 02/13] gobi: Clear out service request queue on shutdown Denis Kenzior
2024-10-31 22:06 ` [PATCH 03/13] simutil: Return early if file is not found Denis Kenzior
2024-10-31 22:06 ` [PATCH 04/13] simfs: Quiet sanitizer runtime error Denis Kenzior
2024-10-31 22:06 ` [PATCH 05/13] radio-settings: quiet " Denis Kenzior
2024-10-31 22:06 ` [PATCH 06/13] gprs: Default CID range to 1..NUM_CONTEXTS -1 Denis Kenzior
2024-10-31 22:06 ` [PATCH 07/13] qmimodem: Drop call to ofono_gprs_set_cid_range Denis Kenzior
2024-10-31 22:06 ` [PATCH 08/13] gobi: Remove support for qmi_wwan_q Denis Kenzior
2024-10-31 22:06 ` [PATCH 09/13] udevng: Remove non-upstream qmi_wwan_q support Denis Kenzior
2024-10-31 22:06 ` [PATCH 10/13] gobi: Bring down the main interface at startup Denis Kenzior
2024-10-31 22:06 ` [PATCH 11/13] gobi: Support only "usb" Bus values Denis Kenzior
2024-10-31 22:06 ` [PATCH 12/13] gobi: document and validate "interfaceNumber" Denis Kenzior
2024-10-31 22:06 ` [PATCH 13/13] qmi: wda: Convert #defines to an enum Denis Kenzior
2024-11-04 22:20 ` [PATCH 01/13] qmi: validate TLV length patchwork-bot+ofono

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.