From 92eefadac7fa7419c851d746f2ca1c29a1657416 Mon Sep 17 00:00:00 2001
From: Naveen Rawat <naveenrawat@codeaurora.org>
Date: Tue, 8 May 2018 09:40:10 -0700
Subject: [PATCH] qcacmn: Fix possible OOB access while sending NAN msg to
 firmware

Fix possible OOB access while sending NAN msg to firmware, by checking
data len calculation against integer overflow and making sure data len
to be less than max wmi msg size.

Change-Id: I98f42b9924a1810282ae3bca031cd5a1e3dd4047
CRs-Fixed: 2205722
---
 wmi/src/wmi_unified_tlv.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/wmi/src/wmi_unified_tlv.c b/wmi/src/wmi_unified_tlv.c
index a50e7b23339d..a54d60359cfc 100644
--- a/wmi/src/wmi_unified_tlv.c
+++ b/wmi/src/wmi_unified_tlv.c
@@ -10424,6 +10424,18 @@ static QDF_STATUS send_nan_req_cmd_tlv(wmi_unified_t wmi_handle,
 	nan_data_len = nan_req->request_data_len;
 	nan_data_len_aligned = roundup(nan_req->request_data_len,
 				       sizeof(uint32_t));
+	if (nan_data_len_aligned < nan_req->request_data_len) {
+		WMI_LOGE("%s: integer overflow while rounding up data_len",
+			 __func__);
+		return QDF_STATUS_E_FAILURE;
+	}
+
+	if (nan_data_len_aligned > WMI_SVC_MSG_MAX_SIZE - WMI_TLV_HDR_SIZE) {
+		WMI_LOGE("%s: wmi_max_msg_size overflow for given datalen",
+			 __func__);
+		return QDF_STATUS_E_FAILURE;
+	}
+
 	len += WMI_TLV_HDR_SIZE + nan_data_len_aligned;
 	buf = wmi_buf_alloc(wmi_handle, len);
 	if (!buf) {