[PATCH 01/13] qmi: validate TLV length

For qmi_result_get_(u)int[8,16,32], make sure that the length
corresponds to the size of the basic type prior to performing the
memcpy.
---
 drivers/qmimodem/qmi.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/drivers/qmimodem/qmi.c b/drivers/qmimodem/qmi.c
index 0ba2e8b9e352..10dbdaac8bf6 100644
--- a/drivers/qmimodem/qmi.c
+++ b/drivers/qmimodem/qmi.c
@@ -2311,7 +2311,7 @@ bool qmi_result_get_uint8(struct qmi_result *result, uint8_t type,
 		return false;
 
 	ptr = tlv_get(result->data, result->length, type, &len);
-	if (!ptr)
+	if (!ptr || len != sizeof(uint8_t))
 		return false;
 
 	if (value)
@@ -2330,7 +2330,7 @@ bool qmi_result_get_int16(struct qmi_result *result, uint8_t type,
 		return false;
 
 	ptr = tlv_get(result->data, result->length, type, &len);
-	if (!ptr)
+	if (!ptr || len != sizeof(int16_t))
 		return false;
 
 	memcpy(&tmp, ptr, 2);
@@ -2351,7 +2351,7 @@ bool qmi_result_get_uint16(struct qmi_result *result, uint8_t type,
 		return false;
 
 	ptr = tlv_get(result->data, result->length, type, &len);
-	if (!ptr)
+	if (!ptr || len != sizeof(uint16_t))
 		return false;
 
 	memcpy(&tmp, ptr, 2);
@@ -2373,7 +2373,7 @@ bool qmi_result_get_uint32(struct qmi_result *result, uint8_t type,
 		return false;
 
 	ptr = tlv_get(result->data, result->length, type, &len);
-	if (!ptr)
+	if (!ptr || len != sizeof(uint32_t))
 		return false;
 
 	memcpy(&tmp, ptr, 4);
@@ -2395,7 +2395,7 @@ bool qmi_result_get_uint64(struct qmi_result *result, uint8_t type,
 		return false;
 
 	ptr = tlv_get(result->data, result->length, type, &len);
-	if (!ptr)
+	if (!ptr || len != sizeof(uint64_t))
 		return false;
 
 	memcpy(&tmp, ptr, 8);
-- 
2.45.2