A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-15 01:01:56 -04:00
Code Issues Projects Releases Packages Wiki Activity

Merge "qcacmn: Fix possible OOB access while sending NAN msg to firmware"

Browse source
This commit is contained in:
Linux Build Service Account 2018-05-16 00:39:39 -07:00 • committed by Gerrit - the friendly Code Review server
commit 5b9f08253e
1 changed files with 12 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

12
wmi/src/wmi_unified_tlv.c
View file

@ -10424,6 +10424,18 @@ static QDF_STATUS send_nan_req_cmd_tlv(wmi_unified_t wmi_handle,
nan_data_len = nan_req->request_data_len;
nan_data_len_aligned = roundup(nan_req->request_data_len,
sizeof(uint32_t));
if (nan_data_len_aligned < nan_req->request_data_len) {
WMI_LOGE("%s: integer overflow while rounding up data_len",
__func__);
return QDF_STATUS_E_FAILURE;
}
if (nan_data_len_aligned > WMI_SVC_MSG_MAX_SIZE - WMI_TLV_HDR_SIZE) {
WMI_LOGE("%s: wmi_max_msg_size overflow for given datalen",
__func__);
return QDF_STATUS_E_FAILURE;
}
len += WMI_TLV_HDR_SIZE + nan_data_len_aligned;
buf = wmi_buf_alloc(wmi_handle, len);
if (!buf) {