From 4aaa6c4946595ea95c7f10daa7c752437a62d362 Mon Sep 17 00:00:00 2001 From: Amar Singhal Date: Tue, 3 Oct 2017 09:48:02 -0700 Subject: [PATCH] qcacld-3.0: Do check for datalen in wma_process_uft_event Check for data length against the size of the structure. Change-Id: Ia8107053ca9c109632ea02a0c8fa677f19e4e225 CRs-Fixed: 2118918 --- core/wma/src/wma_utils.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/core/wma/src/wma_utils.c b/core/wma/src/wma_utils.c index a25ea92bd07a..fcfc99922fef 100644 --- a/core/wma/src/wma_utils.c +++ b/core/wma/src/wma_utils.c @@ -4141,6 +4141,12 @@ wma_process_utf_event(WMA_HANDLE handle, uint8_t *datap, uint32_t dataplen) data = param_buf->data; datalen = param_buf->num_data; + if (datalen < sizeof(segHdrInfo)) { + WMA_LOGE("message size %d is smaller than struct seg_hdr_info", + datalen); + return -EINVAL; + } + segHdrInfo = *(struct seg_hdr_info *) &(data[0]); wma_handle->utf_event_info.currentSeq = (segHdrInfo.segmentInfo & 0xF);