A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-24 13:44:26 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Avoid integer overflow in wma_rx_aggr_failure_event_handler

Browse source 
Add sanity check to ensure num_failure_info from FW does not cause
integer overflow while calculating alloc_len, as alloc_len is in
turn used to malloc which can lead to less than required memory
allocated in case of integer overflow of alloc_len

Change-Id: Iea93e879196e9cd43856a7dcc9204d2304f76c78
CRs-Fixed: 2114789
This commit is contained in:
Vignesh Viswanathan 2017-09-27 20:44:27 +05:30 • committed by snandini
commit 677e3ec4b7
1 changed files with 9 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

9
core/wma/src/wma_features.c
View file

@ -5333,6 +5333,15 @@ int wma_rx_aggr_failure_event_handler(void *handle, u_int8_t *event_buf,
rx_aggr_failure_info = param_buf->fixed_param;
hole_info = param_buf->failure_info;
if (rx_aggr_failure_info->num_failure_info > ((WMI_SVC_MSG_MAX_SIZE -
sizeof(*rx_aggr_hole_event)) /
sizeof(rx_aggr_hole_event->hole_info_array[0]))) {
WMA_LOGE("%s: Excess data from WMI num_failure_info %d",
__func__, rx_aggr_failure_info->num_failure_info);
QDF_ASSERT(0);
return -EINVAL;
}
alloc_len = sizeof(*rx_aggr_hole_event) +
(rx_aggr_failure_info->num_failure_info)*
sizeof(rx_aggr_hole_event->hole_info_array[0]);