Merge "qcacld-3.0: Add sanity check for total_peer_len in wma_get_ll_stats_ext_buf" into wlan-cld3.driver.lnx.2.0-dev

This commit is contained in:
CNSS_WLAN Service 2017-10-23 17:52:48 -07:00 • committed by Gerrit - the friendly Code Review server
commit 516ff26784

View file

@ -767,9 +767,12 @@ static tSirLLStatsResults *wma_get_ll_stats_ext_buf(uint32_t *len,
(sizeof(struct sir_wifi_tx) +
sizeof(struct sir_wifi_rx)));
}
if (peer_num > (WMI_SVC_MSG_MAX_SIZE /
(sizeof(struct sir_wifi_ll_ext_peer_stats) +
total_peer_len))) {
if (total_peer_len > WMI_SVC_MSG_MAX_SIZE) {
excess_data = true;
break;
}
if (peer_num > (WMI_SVC_MSG_MAX_SIZE - total_peer_len) /
sizeof(struct sir_wifi_ll_ext_peer_stats)) {
excess_data = true;
break;
} else {