From 55229dfcecd8eaec0ef15ad49ad33c7cd01b393a Mon Sep 17 00:00:00 2001 From: Abhinav Kumar Date: Tue, 6 Nov 2018 18:52:18 +0530 Subject: [PATCH] qcacmn: Possible Out of bound read in policy_mgr_get_channel_list To prepare the channel list suggestion for a new connection, policy_mgr_get_channel_list invokes policy_mgr_get_valid_chans to get the number of valid channels. Driver uses returned num channel and iterates channel list to divide the list into 2.4 & 5 GHz lists. In case if, num of valid channel returned by policy_mgr_get_valid_chans is greater than the maximum number of channel supported in the channel list, QDF_MAX_NUM_CHAN(128), possible OOB read occurs. Validate the value of chan_index of channel list in policy_mgr_get_channel_list against the maximum number of channels supported in the channel list. Change-Id: I6beb9231aaef491731557434d1ae210ac0bdb036 CRs-Fixed: 2346125 --- umac/cmn_services/policy_mgr/src/wlan_policy_mgr_core.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/umac/cmn_services/policy_mgr/src/wlan_policy_mgr_core.c b/umac/cmn_services/policy_mgr/src/wlan_policy_mgr_core.c index a91ecd9c1f12..f4dc476c016c 100644 --- a/umac/cmn_services/policy_mgr/src/wlan_policy_mgr_core.c +++ b/umac/cmn_services/policy_mgr/src/wlan_policy_mgr_core.c @@ -1972,6 +1972,7 @@ QDF_STATUS policy_mgr_get_channel_list(struct wlan_objmgr_psoc *psoc, } while ((chan_index < num_channels) && + (chan_index < QDF_MAX_NUM_CHAN) && (chan_index_5 < QDF_MAX_NUM_CHAN)) { if ((true == skip_dfs_channel) && wlan_reg_is_dfs_ch(pm_ctx->pdev, @@ -3090,7 +3091,7 @@ void policy_mgr_init_sap_mandatory_2g_chan(struct wlan_objmgr_psoc *psoc) } pm_ctx->sap_mandatory_channels_len = 0; - for (i = 0; i < len; i++) { + for (i = 0; (i < len) && (i < QDF_MAX_NUM_CHAN); i++) { if (WLAN_REG_IS_24GHZ_CH(chan_list[i])) { policy_mgr_debug("Add chan %hu to mandatory list", chan_list[i]);