From 28cf95520fb98d9423b19ef4bd20893aad8fc582 Mon Sep 17 00:00:00 2001 From: Wu Gao Date: Tue, 4 Sep 2018 16:16:37 +0800 Subject: [PATCH] qcacmn: Check number of NOA descriptors There is possible to read buffer overflow. Since it don't check number of NOA descriptor when handling WMI_P2P_NOA_EVENTID. Change-Id: I08fc3ac429bc19a8df7ac429fbe779fa3b227318 CRs-Fixed: 2307321 --- wmi/src/wmi_unified_tlv.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/wmi/src/wmi_unified_tlv.c b/wmi/src/wmi_unified_tlv.c index a25a69b6cb8a..9719965672e5 100644 --- a/wmi/src/wmi_unified_tlv.c +++ b/wmi/src/wmi_unified_tlv.c @@ -18527,6 +18527,11 @@ static QDF_STATUS extract_p2p_noa_ev_param_tlv( (uint8_t) WMI_UNIFIED_NOA_ATTR_CTWIN_GET(wmi_noa_info); descriptors = WMI_UNIFIED_NOA_ATTR_NUM_DESC_GET(wmi_noa_info); param->num_desc = (uint8_t) descriptors; + if (param->num_desc > WMI_P2P_MAX_NOA_DESCRIPTORS) { + WMI_LOGE("%s: invalid num desc:%d", __func__, + param->num_desc); + return QDF_STATUS_E_INVAL; + } WMI_LOGD("%s:index %u, opps_ps %u, ct_window %u, num_descriptors = %u", __func__, param->index, param->opps_ps, param->ct_window,