A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-25 14:13:01 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: Add check for valid length to avoid buffer overflow

Browse source 
Add check for valid length before copying in function
extract_ndp_ind_tlv to avoid potential buffer overflow issue.

CRs-Fixed: 2271344
Change-Id: I2ddcbc46a45d4d5308b1e0cf663598c85512bbaf
This commit is contained in:
Lihua Liu 2018-07-02 18:55:56 +08:00 • committed by nshrivas
commit 0fd49e9a6f
1 changed files with 9 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

9
wmi/src/wmi_unified_tlv.c
View file

@ -16784,10 +16784,19 @@ static QDF_STATUS extract_ndp_ind_tlv(wmi_unified_t wmi_handle,
rsp->ndp_info.ndp_app_info_len = fixed_params->ndp_app_info_len;
rsp->ncs_sk_type = fixed_params->nan_csid;
rsp->scid.scid_len = fixed_params->nan_scid_len;
if (rsp->ndp_config.ndp_cfg_len > NDP_QOS_INFO_LEN)
rsp->ndp_config.ndp_cfg_len = NDP_QOS_INFO_LEN;
qdf_mem_copy(rsp->ndp_config.ndp_cfg, event->ndp_cfg,
rsp->ndp_config.ndp_cfg_len);
if (rsp->ndp_info.ndp_app_info_len > NDP_APP_INFO_LEN)
rsp->ndp_info.ndp_app_info_len = NDP_APP_INFO_LEN;
qdf_mem_copy(rsp->ndp_info.ndp_app_info, event->ndp_app_info,
rsp->ndp_info.ndp_app_info_len);
if (rsp->scid.scid_len > NDP_SCID_BUF_LEN)
rsp->scid.scid_len = NDP_SCID_BUF_LEN;
qdf_mem_copy(rsp->scid.scid, event->ndp_scid, rsp->scid.scid_len);
if (event->ndp_transport_ip_param &&