A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-15 01:01:56 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Add sanity check to avoid overflow in WMI event data

Browse source 
In WMA, data from firmware event buffer is used without
sanity checks for upper limit. This might lead to a potential
integer overflow further leading to buffer corruption.

Add sanity check to avoid integer overflow.

Change-Id: Id47e12015a4d46af24180b621b52ffcb17596c07
CRs-Fixed: 2112832
This commit is contained in:
Sandeep Puligilla 2017-09-20 16:27:43 -07:00 • committed by snandini
commit 2f931531b0
1 changed files with 7 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
core/wma/src/wma_features.c
View file

@ -5224,6 +5224,13 @@ int wma_unified_power_debug_stats_event_handler(void *handle,
return -EINVAL;
}
if (param_buf->num_debug_register > ((WMI_SVC_MSG_MAX_SIZE -
sizeof(wmi_pdev_chip_power_stats_event_fixed_param)) /
sizeof(uint32_t))) {
WMA_LOGE("excess payload: LEN num_debug_register:%u",
param_buf->num_debug_register);
return -EINVAL;
}
debug_registers = param_tlvs->debug_registers;
stats_registers_len =
(sizeof(uint32_t) * param_buf->num_debug_register);