From 4bd222369a6b2852d8d15184fcbc6cdc05752639 Mon Sep 17 00:00:00 2001 From: Amar Singhal Date: Wed, 4 Oct 2017 13:24:00 -0700 Subject: [PATCH] qcacld-3.0: Check for number of entries in fw profiling Number of profile data from firmware cannot be trusted. Check for number of entries against the metadata in TLV header. Change-Id: I0d8078f623a97e33ee1689398c291be75fe9a62a CRs-Fixed: 2119391 --- core/wma/src/wma_utils.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/core/wma/src/wma_utils.c b/core/wma/src/wma_utils.c index fcfc99922fef..5cb5c319fb12 100644 --- a/core/wma/src/wma_utils.c +++ b/core/wma/src/wma_utils.c @@ -520,6 +520,14 @@ int wma_profile_data_report_event_handler(void *handle, uint8_t *event_buf, buf_ptr = buf_ptr + sizeof(wmi_wlan_profile_ctx_t) + WMI_TLV_HDR_SIZE; profile_data = (wmi_wlan_profile_t *) buf_ptr; entries = profile_ctx->bin_count; + + if (entries > param_buf->num_profile_data) { + WMA_LOGE("FW bin count %d more than data %d in TLV hdr", + entries, + param_buf->num_profile_data); + return -EINVAL; + } + QDF_TRACE(QDF_MODULE_ID_WMA, QDF_TRACE_LEVEL_ERROR, "Profile data stats\n"); QDF_TRACE(QDF_MODULE_ID_WMA, QDF_TRACE_LEVEL_ERROR,