A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-30 03:27:44 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: Check endpoint index range

Browse source 
Check endpoint range before it be used.
If endpoint is unused return with error.

Change-Id: I2888b0b66c737df677f09040133503e8ace60510
CRs-Fixed: 2138465
This commit is contained in:
Jiachao Wu 2017-11-10 10:13:38 +08:00 • committed by snandini
commit 15a94747ef
1 changed files with 14 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

16
htc/htc_send.c
View file

@ -1431,7 +1431,13 @@ QDF_STATUS htc_send_pkts_multiple(HTC_HANDLE HTCHandle,
return QDF_STATUS_E_INVAL;
}
AR_DEBUG_ASSERT(pPacket->Endpoint < ENDPOINT_MAX);
if ((pPacket->Endpoint >= ENDPOINT_MAX) ||
(pPacket->Endpoint <= ENDPOINT_UNUSED)) {
AR_DEBUG_PRINTF(ATH_DEBUG_SEND,
("%s endpoint is invalid\n", __func__));
AR_DEBUG_ASSERT(0);
return QDF_STATUS_E_INVAL;
}
pEndpoint = &target->endpoint[pPacket->Endpoint];
if (!pEndpoint->service_id) {
@ -1633,7 +1639,13 @@ QDF_STATUS htc_send_data_pkt(HTC_HANDLE HTCHandle, HTC_PACKET *pPacket,
uint32_t data_attr = 0;
if (pPacket) {
AR_DEBUG_ASSERT(pPacket->Endpoint < ENDPOINT_MAX);
if ((pPacket->Endpoint >= ENDPOINT_MAX) ||
(pPacket->Endpoint <= ENDPOINT_UNUSED)) {
AR_DEBUG_PRINTF(ATH_DEBUG_SEND,
("%s endpoint is invalid\n", __func__));
AR_DEBUG_ASSERT(0);
return QDF_STATUS_E_INVAL;
}
pEndpoint = &target->endpoint[pPacket->Endpoint];
/* add HTC_FRAME_HDR in the initial fragment */