commit 1c43709764d85498ab61ad9a9c17dc8c567eae29
author Linux Build Service Account <lnxbuild@localhost> Tue Mar 03 21:40:39 2015 -0800
committer Gerrit - the friendly Code Review server <code-review@localhost> Tue Mar 03 21:40:39 2015 -0800
tree f6b82587b6cb213ba8415dbb2c487af486ad1ba5
parent be47864a65cbc325a256ae18c7189a973d871142
parent e6c96984d5d74a090a6a35da43b5a4f0bf2e6260

Merge "[qca-ssdk]: Avoid memory overflow in sw_api_ks_netlink.c"

src/sal/sd/linux/uk_interface/sw_api_ks_netlink.c

diff --git a/src/sal/sd/linux/uk_interface/sw_api_ks_netlink.c b/src/sal/sd/linux/uk_interface/sw_api_ks_netlink.c
index 97741d6..145c7cd 100755
--- a/src/sal/sd/linux/uk_interface/sw_api_ks_netlink.c
+++ b/src/sal/sd/linux/uk_interface/sw_api_ks_netlink.c
@@ -314,6 +314,11 @@
 #endif
     }
 
+	if(nlh->nlmsg_len < (SW_MAX_PAYLOAD + sizeof(nlmsghdr)))
+	{
+		dprintk("data length is less than %d bytes\n", SW_MAX_PAYLOAD);
+		SW_OUT_ON_ERROR(SW_ABORTED);
+	}
     aos_mem_copy(args, NLMSG_DATA(nlh), SW_MAX_PAYLOAD);
     /* return API result to user */
     rtn = (a_uint32_t) rv;
@@ -384,6 +389,11 @@
 #endif
     }
 
+	if(nlh->nlmsg_len < (SW_MAX_PAYLOAD + sizeof(nlmsghdr)))
+	{
+		dprintk("data length is less than %d bytes\n", SW_MAX_PAYLOAD);
+		SW_OUT_ON_ERROR(SW_ABORTED);
+	}
     aos_mem_copy(args, NLMSG_DATA(nlh), SW_MAX_PAYLOAD);
 
     rv = sw_api_cmd(args);
@@ -506,6 +516,11 @@
     }
     dst_pid = nlh->nlmsg_pid;
 
+	if(nlh->nlmsg_len < (SW_MAX_PAYLOAD + sizeof(nlmsghdr)))
+	{
+		dprintk("data length is less than %d bytes\n", SW_MAX_PAYLOAD);
+		SW_OUT_ON_ERROR(SW_ABORTED);
+	}
     aos_mem_copy(args, NLMSG_DATA(nlh), SW_MAX_PAYLOAD);
     /* return API result to user */
     rtn = (a_uint32_t) rv;
@@ -574,6 +589,11 @@
     }
     dst_pid = nlh->nlmsg_pid;
 
+	if(nlmsglen < (SW_MAX_PAYLOAD + sizeof(nlmsghdr)))
+	{
+		dprintk("data length is less than %d bytes\n", SW_MAX_PAYLOAD);
+		SW_OUT_ON_ERROR(SW_ABORTED);
+	}
     aos_mem_copy(args, NLMSG_DATA(nlh), SW_MAX_PAYLOAD);
     rv = sw_api_cmd(args);