From 55e1621dd259db9e49c93df843f7bffe1a93ff87 Mon Sep 17 00:00:00 2001
From: Himanshu Agarwal <himanaga@codeaurora.org>
Date: Fri, 22 Dec 2017 16:24:22 +0530
Subject: [PATCH] qcacld-3.0: Add data_len check to avoid OOB access

Add data_len check in wma_nan_rsp_event_handler()
to avoid OOB access.

Change-Id: Iff42da84567381a4b64bc07e69ff1a0cd4b5a543
CRs-Fixed: 2160375
---
 core/wma/src/wma_features.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/core/wma/src/wma_features.c b/core/wma/src/wma_features.c
index 86bdd015e6b7..65adc2541639 100644
--- a/core/wma/src/wma_features.c
+++ b/core/wma/src/wma_features.c
@@ -1326,7 +1326,8 @@ int wma_nan_rsp_event_handler(void *handle, uint8_t *event_buf,
 	alloc_len = sizeof(tSirNanEvent);
 	alloc_len += nan_rsp_event_hdr->data_len;
 	if (nan_rsp_event_hdr->data_len > ((WMI_SVC_MSG_MAX_SIZE -
-	    sizeof(*nan_rsp_event_hdr)) / sizeof(uint8_t))) {
+	    sizeof(*nan_rsp_event_hdr)) / sizeof(uint8_t)) ||
+	    nan_rsp_event_hdr->data_len > param_buf->num_data) {
 		WMA_LOGE("excess data length:%d", nan_rsp_event_hdr->data_len);
 		QDF_ASSERT(0);
 		return -EINVAL;