A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-28 02:32:09 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: Fix potential buffer overflow dp_rx_defrag_waitlist_flush

Browse source 
Currently variable "tid" is from message, which is used
directly as array size which causes buffer over-write.

To address this issue add check for the array size.

Change-Id: I61ffaef69d97936774d89ee4e745ab509d77adb5
CRs-Fixed: 2200862
This commit is contained in:
jitiphil 2018-03-06 18:08:26 +05:30 • committed by nshrivas
commit 301a242a31
1 changed files with 6 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
dp/wifi3.0/dp_rx_defrag.c
View file

@ -134,6 +134,12 @@ void dp_rx_defrag_waitlist_flush(struct dp_soc *soc)
break;
tid = rx_reorder->tid;
if (tid >= DP_MAX_TIDS) {
QDF_TRACE(QDF_MODULE_ID_DP, QDF_TRACE_LEVEL_ERROR,
"%s: TID out of bounds: %d", __func__, tid);
qdf_assert(0);
continue;
}
/* get index 0 of the rx_reorder array */
rx_reorder_base = rx_reorder - tid;
peer =