From 32b2af43650141f732214cf6614f07c6b6820cd9 Mon Sep 17 00:00:00 2001 From: Arun Kumar Khandavalli Date: Tue, 28 May 2019 18:41:27 +0530 Subject: [PATCH] qcacld-3.0: Sanitize the mc address list count In the target_if layer based on the mc address list count the filter params are filled and sent to the firmware. If the mc address list passed is more than the maximum supported address list there can be possible buffer overflow. Sanitize the mc address list count to avoid any overflow. CRs-Fixed: 2452131 Change-Id: I03208a5487cfd730e933666c47accb2e46fbbc72 --- components/pmo/core/src/wlan_pmo_mc_addr_filtering.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/components/pmo/core/src/wlan_pmo_mc_addr_filtering.c b/components/pmo/core/src/wlan_pmo_mc_addr_filtering.c index c0df46b0e072..6f88b0edd4d0 100644 --- a/components/pmo/core/src/wlan_pmo_mc_addr_filtering.c +++ b/components/pmo/core/src/wlan_pmo_mc_addr_filtering.c @@ -341,6 +341,12 @@ static QDF_STATUS pmo_core_mc_addr_flitering_sanity( return QDF_STATUS_E_INVAL; } + if (vdev_ctx->vdev_mc_list_req.mc_cnt > PMO_MAX_MC_ADDR_LIST) { + pmo_debug("Passed more than max supported MC address count :%d", + vdev_ctx->vdev_mc_list_req.mc_cnt); + return QDF_STATUS_E_INVAL; + } + return QDF_STATUS_SUCCESS; } QDF_STATUS pmo_core_cache_mc_addr_list(