GitHub-Mirror/Star64_linux
2
0
Fork 0
mirror of https://github.com/Fishwaldo/Star64_linux.git synced 2025-04-05 05:54:25 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

NFC: nci: fix possible crash in nci_core_conn_create

Browse source 
If the number of destination speific parameters supplied is 0
the call will fail. If the first destination specific parameter
does not have a value, curr_id will be set to 0.

Signed-off-by: Robert Dolca <robert.dolca@intel.com>
Signed-off-by: Samuel Ortiz <sameo@linux.intel.com>
This commit is contained in:
Robert Dolca 2015-10-22 12:11:40 +03:00 • committed by Samuel Ortiz
parent 22e4bd09c4
commit caa575a86e
1 changed files with 8 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

7
net/nfc/nci/core.c
View file

@ -602,12 +602,19 @@ int nci_core_conn_create(struct nci_dev *ndev, u8 destination_type,
if (!cmd) if (!cmd)
return -ENOMEM; return -ENOMEM;
if (!number_destination_params)
return -EINVAL;
cmd->destination_type = destination_type; cmd->destination_type = destination_type;
cmd->number_destination_params = number_destination_params; cmd->number_destination_params = number_destination_params;
memcpy(cmd->params, params, params_len); memcpy(cmd->params, params, params_len);
data.cmd = cmd; data.cmd = cmd;
if (params->length > 0)
ndev->cur_id = params->value[DEST_SPEC_PARAMS_ID_INDEX]; ndev->cur_id = params->value[DEST_SPEC_PARAMS_ID_INDEX];
else
ndev->cur_id = 0;
r = __nci_request(ndev, nci_core_conn_create_req, r = __nci_request(ndev, nci_core_conn_create_req,
(unsigned long)&data, (unsigned long)&data,