A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-12 07:37:31 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Add data_len check to avoid OOB access

Browse source 
Add data_len check in wma_nan_rsp_event_handler()
to avoid OOB access.

Change-Id: Iff42da84567381a4b64bc07e69ff1a0cd4b5a543
CRs-Fixed: 2160375
This commit is contained in:
Himanshu Agarwal 2017-12-22 16:24:22 +05:30 • committed by snandini
commit 55e1621dd2
1 changed files with 2 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
core/wma/src/wma_features.c
View file

@ -1326,7 +1326,8 @@ int wma_nan_rsp_event_handler(void *handle, uint8_t *event_buf,
alloc_len = sizeof(tSirNanEvent);
alloc_len += nan_rsp_event_hdr->data_len;
if (nan_rsp_event_hdr->data_len > ((WMI_SVC_MSG_MAX_SIZE -
sizeof(*nan_rsp_event_hdr)) / sizeof(uint8_t))) {
sizeof(*nan_rsp_event_hdr)) / sizeof(uint8_t)) ||
nan_rsp_event_hdr->data_len > param_buf->num_data) {
WMA_LOGE("excess data length:%d", nan_rsp_event_hdr->data_len);
QDF_ASSERT(0);
return -EINVAL;