A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-14 08:36:12 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Add bound check for numap to avoid integer overflow

Browse source 
Currently, numap is int and is assigned with a uint32 value from
fw which might lead to integer overflow. Also, when multiplying
the uint32 value with sizeof dest_ap could lead to int overflow
if the value of numap is close to uint32's maximum limit.

Fix/Modify numap to uint32 to be in sync with value from fw cmd.
Also add check to trim down numap value to max (10) if value is
greater than max (10).

Change-Id: I060f585c8c951807cd32b5eec75c1bad2e84a75b
CRs-Fixed: 2082665
This commit is contained in:
Sridhar Selvaraj 2017-07-26 15:06:40 +05:30 • committed by snandini
commit 22943574b2
1 changed files with 13 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

14
core/wma/src/wma_scan_roam.c
View file

@ -103,6 +103,12 @@ enum extscan_report_events_type {
};
#define WMA_EXTSCAN_CYCLE_WAKE_LOCK_DURATION (5 * 1000) /* in msec */
/*
* Maximum number of entires that could be present in the
* WMI_EXTSCAN_HOTLIST_MATCH_EVENT buffer from the firmware
*/
#define WMA_EXTSCAN_MAX_HOTLIST_ENTRIES 10
#endif
/**
@ -3733,7 +3739,8 @@ int wma_extscan_hotlist_match_event_handler(void *handle,
struct extscan_hotlist_match *dest_hotlist;
tSirWifiScanResult *dest_ap;
wmi_extscan_wlan_descriptor *src_hotlist;
int numap, j, ap_found = 0;
uint32_t numap;
int j, ap_found = 0;
tpAniSirGlobal pMac = cds_get_context(QDF_MODULE_ID_PE);
if (!pMac) {
@ -3758,6 +3765,11 @@ int wma_extscan_hotlist_match_event_handler(void *handle,
WMA_LOGE("%s: Hotlist AP's list invalid", __func__);
return -EINVAL;
}
if (numap > WMA_EXTSCAN_MAX_HOTLIST_ENTRIES) {
WMA_LOGE("%s: Total Entries %u greater than max",
__func__, numap);
numap = WMA_EXTSCAN_MAX_HOTLIST_ENTRIES;
}
dest_hotlist = qdf_mem_malloc(sizeof(*dest_hotlist) +
sizeof(*dest_ap) * numap);
if (!dest_hotlist) {