From 71596f796dfa9c2a25e9ed58aff16e6f5e4422d5 Mon Sep 17 00:00:00 2001 From: Pragaspathi Thilagaraj Date: Wed, 11 Apr 2018 03:48:42 -0700 Subject: [PATCH] Revert "qcacld-3.0: Fix OOB write in wma_unified_debug_print_event_handler" The change for the CR 2211133 caused compilation issue in LE branches. This reverts commit with change Id-I45943ae76d8fcf7b53e1f064c462d01cd6d00dcf Change-Id: I069f1a4ae8ad320f5a073ee072dd772e05c5fc5d CRs-Fixed: 2222536 --- core/wma/src/wma_utils.c | 24 ++++++------------------ 1 file changed, 6 insertions(+), 18 deletions(-) diff --git a/core/wma/src/wma_utils.c b/core/wma/src/wma_utils.c index 8e1a2dd8049d..c68bd197d8d1 100644 --- a/core/wma/src/wma_utils.c +++ b/core/wma/src/wma_utils.c @@ -3525,43 +3525,31 @@ int wma_unified_debug_print_event_handler(void *handle, uint8_t *datap, WMI_DEBUG_PRINT_EVENTID_param_tlvs *param_buf; uint8_t *data; uint32_t datalen; - char dbgbuf[WMI_SVC_MSG_MAX_SIZE] = { 0 }; param_buf = (WMI_DEBUG_PRINT_EVENTID_param_tlvs *) datap; - if (!param_buf || !param_buf->data) { + if (!param_buf) { WMA_LOGE("Get NULL point message from FW"); return -ENOMEM; } data = param_buf->data; datalen = param_buf->num_data; - if (datalen > WMI_SVC_MSG_MAX_SIZE) { - WMA_LOGE("Received data len %d exceeds max value %d", - datalen, WMI_SVC_MSG_MAX_SIZE); - return QDF_STATUS_E_FAILURE; - } #ifdef BIG_ENDIAN_HOST { - if (datalen >= BIG_ENDIAN_MAX_DEBUG_BUF) { + if (datalen > BIG_ENDIAN_MAX_DEBUG_BUF) { WMA_LOGE("%s Invalid data len %d, limiting to max", __func__, datalen); - datalen = BIG_ENDIAN_MAX_DEBUG_BUF-1; + datalen = BIG_ENDIAN_MAX_DEBUG_BUF; } + char dbgbuf[BIG_ENDIAN_MAX_DEBUG_BUF] = { 0 }; - strlcpy(dbgbuf, data, datalen); + memcpy(dbgbuf, data, datalen); SWAPME(dbgbuf, datalen); WMA_LOGD("FIRMWARE:%s", dbgbuf); return 0; } #else - if (datalen == WMI_SVC_MSG_MAX_SIZE) { - WMA_LOGE("%s Invalid data len %d, limiting to max", - __func__, datalen); - datalen = WMI_SVC_MSG_MAX_SIZE -1 ; - } - - strlcpy(dbgbuf, data, datalen); - WMA_LOGD("FIRMWARE:%s", dbgbuf); + WMA_LOGD("FIRMWARE:%s", data); return 0; #endif /* BIG_ENDIAN_HOST */ }