From 69280df6ee960700fc0d486fbc5c445998e1e5a5 Mon Sep 17 00:00:00 2001 From: Dustin Brown Date: Fri, 9 Jun 2017 11:37:19 -0700 Subject: [PATCH] qcacmn: Fix bounds check in populate_mac_phy_capability In populate_mac_phy_capability, bounds on an array are checked after writing to the array. This leads to writing to one past the end of the array under error conditions. Check the bounds of the array before, rather than after, writing to it in populate_mac_phy_capability. Change-Id: I34c7415b8fb925bea5a715214e3aa3ac8a4bacc8 CRs-Fixed: 2059155 --- .../init_deinit/src/service_ready_event_handler.c | 12 +++++++----- 1 file changed, 7 insertions(+), 5 deletions(-) diff --git a/target_if/init_deinit/src/service_ready_event_handler.c b/target_if/init_deinit/src/service_ready_event_handler.c index 166a47a3a192..b416054a9af6 100644 --- a/target_if/init_deinit/src/service_ready_event_handler.c +++ b/target_if/init_deinit/src/service_ready_event_handler.c @@ -168,6 +168,12 @@ static int populate_mac_phy_capability(void *handle, uint8_t *evt, mac_phy_id = 0; while (phy_bit_map) { + if (*total_mac_phy >= PSOC_MAX_MAC_PHY_CAP) { + WMI_LOGE("total mac phy exceeds max limit %d", + *total_mac_phy); + return -EINVAL; + } + status = wmi_extract_mac_phy_cap_service_ready_ext(handle, evt, hw_mode_id, mac_phy_id, &(service_param->mac_phy_cap[*total_mac_phy])); @@ -175,12 +181,8 @@ static int populate_mac_phy_capability(void *handle, uint8_t *evt, WMI_LOGE("failed to parse mac phy capability"); return qdf_status_to_os_return(status); } + (*total_mac_phy)++; - if (*total_mac_phy > PSOC_MAX_MAC_PHY_CAP) { - WMI_LOGE("total mac phy exceeds max limit %d", - *total_mac_phy); - return -EINVAL; - } phy_bit_map &= (phy_bit_map - 1); mac_phy_id++; }