net: qrtr: Fix an out of bounds read qrtr_endpoint_post()
commit 8ff41cc2 upstream. This code assumes that the user passed in enough data for a qrtr_hdr_v1 or qrtr_hdr_v2 struct, but it's not necessarily true. If the buffer is too small then it will read beyond the end. Reported-by:Manivannan Sadhasivam <manivannan.sadhasivam@linaro.org> Reported-by:
<syzbot+b8fe393f999a291a9ea6@syzkaller.appspotmail.com> Fixes: 194ccc88 ("net: qrtr: Support decoding incoming v2 packets") Signed-off-by:
Dan Carpenter <dan.carpenter@oracle.com> Signed-off-by:
David S. Miller <davem@davemloft.net> Signed-off-by:
Greg Kroah-Hartman <gregkh@linuxfoundation.org>
parent
fa4a80a1
Please register or sign in to comment