From 4e3f275a80a3c07932c39ac064494f9c0d81f3c4 Mon Sep 17 00:00:00 2001 From: Bala Venkatesh Date: Tue, 18 Jun 2019 19:35:16 +0530 Subject: [PATCH] qcacld-3.0: Avoid OOB in function tdls_ct_idle_handler In function tdls_ct_idle_handler, idx is assigned from tdls_info->index which can be 0 254. But tdls_conn_info is static array in tdls_soc_priv_obj of size WLAN_TDLS_STA_MAX_NUM (8). So check idx is less than WLAN_TDLS_STA_MAX_NUM or not to avoid OOB memory access. Change-Id: I8387cb0a44a79f0f83b25c12de2aa9fbc39ab2f3 CRs-Fixed: 2474432 --- components/tdls/core/src/wlan_tdls_ct.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/components/tdls/core/src/wlan_tdls_ct.c b/components/tdls/core/src/wlan_tdls_ct.c index 8327e7bb344e..32797da7cda8 100644 --- a/components/tdls/core/src/wlan_tdls_ct.c +++ b/components/tdls/core/src/wlan_tdls_ct.c @@ -639,7 +639,7 @@ void tdls_ct_idle_handler(void *user_data) return; idx = tdls_info->index; - if (tdls_info->index == INVALID_TDLS_PEER_INDEX) + if (idx == INVALID_TDLS_PEER_INDEX || idx >= WLAN_TDLS_STA_MAX_NUM) return; tdls_soc_obj = qdf_container_of(tdls_info, struct tdls_soc_priv_obj,