From 04c945017f750d4da481cd3a03f608dec9f667a5 Mon Sep 17 00:00:00 2001 From: Jingxiang Ge Date: Wed, 18 Oct 2017 17:05:40 +0800 Subject: [PATCH] qcacld-3.0: Add buffer length check to avoid over-read In wma_mgmt_rx_process, mgmt_rx_params->buf_len is read from message, if mgmt_rx_params->buf_len is larger than data_len, it is possible to over-read from bufp with corrupted message. Change-Id: I7f06d81fd18960d0d6c57cdb4594680178022087 CRs-Fixed: 2126972 --- core/wma/src/wma_mgmt.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/core/wma/src/wma_mgmt.c b/core/wma/src/wma_mgmt.c index b5d8cc519a3f..4a4ec1abc749 100644 --- a/core/wma/src/wma_mgmt.c +++ b/core/wma/src/wma_mgmt.c @@ -3781,6 +3781,12 @@ static int wma_mgmt_rx_process(void *handle, uint8_t *data, return -EINVAL; } + if (mgmt_rx_params->buf_len > data_len) { + WMA_LOGE("%s: Invalid rx mgmt packet, data_len %u, mgmt_rx_params->buf_len %u", + __func__, data_len, mgmt_rx_params->buf_len); + return -EINVAL; + } + mgmt_rx_params->pdev_id = 0; mgmt_rx_params->rx_params = NULL;