diff options
Diffstat (limited to 'samsung-ipc/devices/xmm626/xmm626_sec_modem.c')
| -rw-r--r-- | samsung-ipc/devices/xmm626/xmm626_sec_modem.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/samsung-ipc/devices/xmm626/xmm626_sec_modem.c b/samsung-ipc/devices/xmm626/xmm626_sec_modem.c index eedce07..ffe46a5 100644 --- a/samsung-ipc/devices/xmm626/xmm626_sec_modem.c +++ b/samsung-ipc/devices/xmm626/xmm626_sec_modem.c @@ -360,6 +360,10 @@ int xmm626_sec_modem_rfs_recv(struct ipc_client *client, } header = (struct ipc_rfs_header *) buffer; + if (header->length > XMM626_DATA_SIZE_LIMIT) { + ipc_client_log(client, "Invalid RFS header length: %u", header->length); + goto error; + } ipc_rfs_message_setup(header, message); |