From 4576e298cab7ae2cc6e0072da84dcb5eaedc8ba7 Mon Sep 17 00:00:00 2001 From: Arif Hussain Date: Fri, 21 Dec 2018 14:58:55 -0800 Subject: [PATCH] qcacmn: Validate number of entries in extract_host_mem_req_tlv() Validate num_mem_reqs should be less than TLV size in extract_host_mem_req_tlv() function. Change-Id: I88ebfc4bfe3abb9b0926990f5f777fc0d62e1fc1 CRs-Fixed: 2347667 --- wmi/src/wmi_unified_tlv.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/wmi/src/wmi_unified_tlv.c b/wmi/src/wmi_unified_tlv.c index 2bb995a33374..23fb9d19a187 100644 --- a/wmi/src/wmi_unified_tlv.c +++ b/wmi/src/wmi_unified_tlv.c @@ -8157,6 +8157,12 @@ static host_mem_req *extract_host_mem_req_tlv(wmi_unified_t wmi_handle, return NULL; } + if (ev->num_mem_reqs > param_buf->num_mem_reqs) { + WMI_LOGE("Invalid num_mem_reqs %d:%d", + ev->num_mem_reqs, param_buf->num_mem_reqs); + return NULL; + } + *num_entries = ev->num_mem_reqs; return (host_mem_req *)param_buf->mem_reqs;