From 337c5c6adabb472adfa9ccdc01519781e76602fd Mon Sep 17 00:00:00 2001 From: Alok Kumar Date: Fri, 9 Feb 2018 18:19:49 +0530 Subject: [PATCH] qcacmn: Fix buffer overflow in fill_ieee80211_hdr_data Currently variable pl_msdu_info->num_msdu is from message, and is used directly as array size. This may cause buffer overflow. To address this issue add qdf_assert check. Change-Id: Ice78633314b321243136ce4987c633e1201d3cb8 CRs-Fixed: 2187441 --- utils/pktlog/pktlog_internal.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/utils/pktlog/pktlog_internal.c b/utils/pktlog/pktlog_internal.c index 892028340300..105f52fcfac2 100644 --- a/utils/pktlog/pktlog_internal.c +++ b/utils/pktlog/pktlog_internal.c @@ -280,6 +280,13 @@ fill_ieee80211_hdr_data(struct cdp_pdev *pdev, pl_msdu_info->priv_size = sizeof(uint32_t) * pl_msdu_info->num_msdu + sizeof(uint32_t); + if (pl_msdu_info->num_msdu > MAX_PKT_INFO_MSDU_ID) { + QDF_TRACE(QDF_MODULE_ID_TXRX, QDF_TRACE_LEVEL_ERROR, + "%s: Invalid num_msdu count", + __func__); + qdf_assert(0); + return; + } for (i = 0; i < pl_msdu_info->num_msdu; i++) { /* * Handle big endianness