A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-24 13:44:26 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix buffer overflow in wma_pdev_hw_mode_transition_evt_handler

Browse source 
Make sure num_vdev_mac_entries which is coming from firmware within
MAX_VDEV_SUPPORTED to avoid any buffer overflow or OOB read.

Change-Id: I92793a6bcfd46b288c3f496a6f6cc9b372f60c48
CRs-Fixed: 2119432
This commit is contained in:
Arif Hussain 2017-10-04 17:25:24 -07:00 • committed by snandini
commit 34f720671a
1 changed files with 7 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
core/wma/src/wma_main.c
View file

@ -3301,6 +3301,13 @@ static int wma_pdev_hw_mode_transition_evt_handler(void *handle,
return QDF_STATUS_E_FAILURE;
}
if (param_buf->fixed_param->num_vdev_mac_entries > MAX_VDEV_SUPPORTED) {
WMA_LOGE("num_vdev_mac_entries: %d crossed max value: %d",
param_buf->fixed_param->num_vdev_mac_entries,
MAX_VDEV_SUPPORTED);
return QDF_STATUS_E_FAILURE;
}
hw_mode_trans_ind = qdf_mem_malloc(sizeof(*hw_mode_trans_ind));
if (!hw_mode_trans_ind) {
WMA_LOGE("%s: Memory allocation failed", __func__);