From 34f720671a8d49555f65c1ed132e9762286decc4 Mon Sep 17 00:00:00 2001 From: Arif Hussain Date: Wed, 4 Oct 2017 17:25:24 -0700 Subject: [PATCH] qcacld-3.0: Fix buffer overflow in wma_pdev_hw_mode_transition_evt_handler Make sure num_vdev_mac_entries which is coming from firmware within MAX_VDEV_SUPPORTED to avoid any buffer overflow or OOB read. Change-Id: I92793a6bcfd46b288c3f496a6f6cc9b372f60c48 CRs-Fixed: 2119432 --- core/wma/src/wma_main.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/core/wma/src/wma_main.c b/core/wma/src/wma_main.c index 0c2446aad90d..be4baae947de 100644 --- a/core/wma/src/wma_main.c +++ b/core/wma/src/wma_main.c @@ -3301,6 +3301,13 @@ static int wma_pdev_hw_mode_transition_evt_handler(void *handle, return QDF_STATUS_E_FAILURE; } + if (param_buf->fixed_param->num_vdev_mac_entries > MAX_VDEV_SUPPORTED) { + WMA_LOGE("num_vdev_mac_entries: %d crossed max value: %d", + param_buf->fixed_param->num_vdev_mac_entries, + MAX_VDEV_SUPPORTED); + return QDF_STATUS_E_FAILURE; + } + hw_mode_trans_ind = qdf_mem_malloc(sizeof(*hw_mode_trans_ind)); if (!hw_mode_trans_ind) { WMA_LOGE("%s: Memory allocation failed", __func__);