A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-08 12:58:12 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: Validate the buffer length in rx mgmt handler

Browse source 
In the WMI_MGMT_RX_EVENTID event handling, add a length
check to validate if the buffer length sent by the firmware
is less than or equal to the actual buffer length.

Change-Id: I7db9af48bc525543b972dcaf40aee0a05d8f5023
CRs-Fixed: 3001331
This commit is contained in:
Surya Prakash Sivaraj 2021-08-05 11:13:12 +05:30 • committed by Madan Koyyalamudi
commit 3fd0eae263
1 changed files with 5 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
wmi/src/wmi_unified_tlv.c
View file

@ -10249,6 +10249,11 @@ static QDF_STATUS extract_mgmt_rx_params_tlv(wmi_unified_t wmi_handle,
return QDF_STATUS_E_INVAL;
}
if (ev_hdr->buf_len > param_tlvs->num_bufp) {
wmi_err("Rx mgmt frame length mismatch, discard it");
return QDF_STATUS_E_INVAL;
}
hdr->pdev_id = wmi_handle->ops->convert_pdev_id_target_to_host(
wmi_handle,
ev_hdr->pdev_id);