From 7b038cad15bfef9a76b11782d088a9a74ff28f2a Mon Sep 17 00:00:00 2001 From: Amar Singhal Date: Wed, 4 Oct 2017 13:38:39 -0700 Subject: [PATCH] qcacld-3.0: Check number of dbs hw modes In WMI_SERVICE_READY_EVENTID, check for number of dbs HW modes against the metadata. Change-Id: I043c93c4e6bc0dfdd73dbdc65bab683c56269308 CRs-Fixed: 2119387 --- core/wma/src/wma_main.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/core/wma/src/wma_main.c b/core/wma/src/wma_main.c index e2b8545df4fd..dbdd1aa82b00 100644 --- a/core/wma/src/wma_main.c +++ b/core/wma/src/wma_main.c @@ -4966,6 +4966,13 @@ int wma_rx_service_ready_event(void *handle, uint8_t *cmd_param_info, WMA_LOGD("WMA <-- WMI_SERVICE_READY_EVENTID"); + if (ev->num_dbs_hw_modes > param_buf->num_wlan_dbs_hw_mode_list) { + WMA_LOGE("FW dbs_hw_mode entry %d more than value %d in TLV hdr", + ev->num_dbs_hw_modes, + param_buf->num_wlan_dbs_hw_mode_list); + return -EINVAL; + } + wma_handle->num_dbs_hw_modes = ev->num_dbs_hw_modes; ev_wlan_dbs_hw_mode_list = param_buf->wlan_dbs_hw_mode_list; wma_handle->hw_mode.hw_mode_list =