From 15a94747eff840ace1c093f1555f77a8b8048769 Mon Sep 17 00:00:00 2001 From: Jiachao Wu Date: Fri, 10 Nov 2017 10:13:38 +0800 Subject: [PATCH] qcacmn: Check endpoint index range Check endpoint range before it be used. If endpoint is unused return with error. Change-Id: I2888b0b66c737df677f09040133503e8ace60510 CRs-Fixed: 2138465 --- htc/htc_send.c | 16 ++++++++++++++-- 1 file changed, 14 insertions(+), 2 deletions(-) diff --git a/htc/htc_send.c b/htc/htc_send.c index 91aeec425f16..09d87f178cad 100644 --- a/htc/htc_send.c +++ b/htc/htc_send.c @@ -1431,7 +1431,13 @@ QDF_STATUS htc_send_pkts_multiple(HTC_HANDLE HTCHandle, return QDF_STATUS_E_INVAL; } - AR_DEBUG_ASSERT(pPacket->Endpoint < ENDPOINT_MAX); + if ((pPacket->Endpoint >= ENDPOINT_MAX) || + (pPacket->Endpoint <= ENDPOINT_UNUSED)) { + AR_DEBUG_PRINTF(ATH_DEBUG_SEND, + ("%s endpoint is invalid\n", __func__)); + AR_DEBUG_ASSERT(0); + return QDF_STATUS_E_INVAL; + } pEndpoint = &target->endpoint[pPacket->Endpoint]; if (!pEndpoint->service_id) { @@ -1633,7 +1639,13 @@ QDF_STATUS htc_send_data_pkt(HTC_HANDLE HTCHandle, HTC_PACKET *pPacket, uint32_t data_attr = 0; if (pPacket) { - AR_DEBUG_ASSERT(pPacket->Endpoint < ENDPOINT_MAX); + if ((pPacket->Endpoint >= ENDPOINT_MAX) || + (pPacket->Endpoint <= ENDPOINT_UNUSED)) { + AR_DEBUG_PRINTF(ATH_DEBUG_SEND, + ("%s endpoint is invalid\n", __func__)); + AR_DEBUG_ASSERT(0); + return QDF_STATUS_E_INVAL; + } pEndpoint = &target->endpoint[pPacket->Endpoint]; /* add HTC_FRAME_HDR in the initial fragment */