From 7bfb1e9bafad730656206014a60228abc2ec96c4 Mon Sep 17 00:00:00 2001 From: Pragaspathi Thilagaraj Date: Tue, 1 May 2018 12:32:47 +0530 Subject: [PATCH] qcacmn: Fix OOB read in iw_hdd_set_var_ints_getnone From the IOCTL command WE_POLICY_MANAGER_PCL_CMD, we get the cds concurrency mode as argument and pass it to cds_get_pcl to get the pcl channel list. This concurrency mode parameter is used as the array index to retrieve the enum cds_pcl_type. If this value is greater than CDS_MAX_NUM_OF_MODE an OOB read will occur in iw_hdd_set_var_ints_getnone. Add check to validate the input cds mode argument against the macro CDS_MAX_NUM_OF_MODE. Return error if it is violated. Change-Id: I51073061be363d9680abf0566b77be7c7573d0fe CRs-Fixed: 2233991 --- umac/cmn_services/policy_mgr/src/wlan_policy_mgr_pcl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/umac/cmn_services/policy_mgr/src/wlan_policy_mgr_pcl.c b/umac/cmn_services/policy_mgr/src/wlan_policy_mgr_pcl.c index 88a58f085785..5303ee8092d1 100644 --- a/umac/cmn_services/policy_mgr/src/wlan_policy_mgr_pcl.c +++ b/umac/cmn_services/policy_mgr/src/wlan_policy_mgr_pcl.c @@ -476,8 +476,8 @@ QDF_STATUS policy_mgr_get_pcl(struct wlan_objmgr_psoc *psoc, return status; } - if (mode >= PM_MAX_NUM_OF_MODE) { - policy_mgr_err("requested mode:%d is not supported", mode); + if ((mode < 0) || (mode >= PM_MAX_NUM_OF_MODE)) { + policy_mgr_err("Invalid connection mode %d received", mode); return status; }