From 301a242a3148eea11e65392d04a136c6a6dd14a9 Mon Sep 17 00:00:00 2001
From: jitiphil <jitiphil@codeaurora.org>
Date: Tue, 6 Mar 2018 18:08:26 +0530
Subject: [PATCH] qcacmn: Fix potential buffer overflow
 dp_rx_defrag_waitlist_flush

Currently variable "tid" is from message, which is used
directly as array size which causes buffer over-write.

To address this issue add check for the array size.

Change-Id: I61ffaef69d97936774d89ee4e745ab509d77adb5
CRs-Fixed: 2200862
---
 dp/wifi3.0/dp_rx_defrag.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/dp/wifi3.0/dp_rx_defrag.c b/dp/wifi3.0/dp_rx_defrag.c
index c6d3f5b283a2..7655db9e9de2 100644
--- a/dp/wifi3.0/dp_rx_defrag.c
+++ b/dp/wifi3.0/dp_rx_defrag.c
@@ -134,6 +134,12 @@ void dp_rx_defrag_waitlist_flush(struct dp_soc *soc)
 			break;
 
 		tid = rx_reorder->tid;
+		if (tid >= DP_MAX_TIDS) {
+			QDF_TRACE(QDF_MODULE_ID_DP, QDF_TRACE_LEVEL_ERROR,
+				  "%s: TID out of bounds: %d", __func__, tid);
+			qdf_assert(0);
+			continue;
+		}
 		/* get index 0 of the rx_reorder array */
 		rx_reorder_base = rx_reorder - tid;
 		peer =