From 2f931531b03e56e6495133097a98ae825e95aec4 Mon Sep 17 00:00:00 2001 From: Sandeep Puligilla Date: Wed, 20 Sep 2017 16:27:43 -0700 Subject: [PATCH] qcacld-3.0: Add sanity check to avoid overflow in WMI event data In WMA, data from firmware event buffer is used without sanity checks for upper limit. This might lead to a potential integer overflow further leading to buffer corruption. Add sanity check to avoid integer overflow. Change-Id: Id47e12015a4d46af24180b621b52ffcb17596c07 CRs-Fixed: 2112832 --- core/wma/src/wma_features.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/core/wma/src/wma_features.c b/core/wma/src/wma_features.c index 7932fbb74bd5..80d62024cd26 100644 --- a/core/wma/src/wma_features.c +++ b/core/wma/src/wma_features.c @@ -5224,6 +5224,13 @@ int wma_unified_power_debug_stats_event_handler(void *handle, return -EINVAL; } + if (param_buf->num_debug_register > ((WMI_SVC_MSG_MAX_SIZE - + sizeof(wmi_pdev_chip_power_stats_event_fixed_param)) / + sizeof(uint32_t))) { + WMA_LOGE("excess payload: LEN num_debug_register:%u", + param_buf->num_debug_register); + return -EINVAL; + } debug_registers = param_tlvs->debug_registers; stats_registers_len = (sizeof(uint32_t) * param_buf->num_debug_register);