From 02139a7de9d2df25f63d9e6f75be9ffe2449ab9d Mon Sep 17 00:00:00 2001 From: Sravan Kumar Kairam Date: Fri, 4 Aug 2017 12:32:07 +0530 Subject: [PATCH] qcacmn: Validate buffer length in wmi tlv check and pad tlvs Currently there is no validation of the buffer length passed by the caller in the function to validate the TLV's coming for an event/ command. This may cause possible null pointer reference. In this change validate the buffer length passed by the caller. Change-Id: Ia365cf78acce3a235b9e15e6ed95a1aaa06b4c6f CRs-Fixed: 2105739 --- wmi/src/wmi_tlv_helper.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/wmi/src/wmi_tlv_helper.c b/wmi/src/wmi_tlv_helper.c index 124615201063..b6931f51a0fa 100644 --- a/wmi/src/wmi_tlv_helper.c +++ b/wmi/src/wmi_tlv_helper.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved. + * Copyright (c) 2013-2017 The Linux Foundation. All rights reserved. * * Previously licensed under the ISC license by Qualcomm Atheros, Inc. * @@ -518,6 +518,13 @@ wmitlv_check_and_pad_tlvs(void *os_handle, void *param_struc_ptr, } /* NOTE: the returned number of TLVs is in "attr_struct_ptr.cmd_num_tlv" */ + if (param_buf_len < WMI_TLV_HDR_SIZE) { + wmi_tlv_print_error + ("%s: ERROR: Incorrect param buf length passed\n", + __func__); + return error; + } + /* Create base structure of format wmi_cmd_event_id##_param_tlvs */ len_wmi_cmd_struct_buf = attr_struct_ptr.cmd_num_tlv * sizeof(wmitlv_cmd_param_info);