A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-14 08:36:12 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: Fix integer overflow in roam scan stats extract

Browse source 
In extract_roam_scan_stats_res_evt_tlv(), validate
num_roam_scans to avoid any possible integer overflow
when receive larger num_roam_scans value.

Change-Id: I0f3bbf64fac8c151789de2f93a77c9af29b855d1
CRs-Fixed: 2331868
This commit is contained in:
Arif Hussain 2018-10-17 09:36:11 -07:00 • committed by nshrivas
commit 03673ae28f
1 changed files with 9 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

13
wmi/src/wmi_unified_tlv.c
View file

@ -10354,7 +10354,7 @@ extract_roam_scan_stats_res_evt_tlv(wmi_unified_t wmi_handle, void *evt_buf,
uint32_t total_len;
struct wmi_roam_scan_stats_res *res;
uint32_t i, j;
uint32_t num_scans;
uint32_t num_scans, scan_param_size;
*res_param = NULL;
*vdev_id = 0xFF; /* Initialize to invalid vdev id */
@ -10365,11 +10365,16 @@ extract_roam_scan_stats_res_evt_tlv(wmi_unified_t wmi_handle, void *evt_buf,
}
fixed_param = param_buf->fixed_param;
total_len = sizeof(*res) + fixed_param->num_roam_scans *
sizeof(struct wmi_roam_scan_stats_params);
*vdev_id = fixed_param->vdev_id;
num_scans = fixed_param->num_roam_scans;
scan_param_size = sizeof(struct wmi_roam_scan_stats_params);
if ((num_scans > ((UINT_MAX - sizeof(*res)) / scan_param_size))) {
wmi_err_rl("Invalid num_roam_scans %d", num_scans);
return QDF_STATUS_E_INVAL;
}
total_len = sizeof(*res) + num_scans * scan_param_size;
*vdev_id = fixed_param->vdev_id;
res = qdf_mem_malloc(total_len);
if (!res) {