From 7f5642ae4bebdca7b6078a491b67646b58a23aab Mon Sep 17 00:00:00 2001 From: Amar Singhal Date: Tue, 3 Oct 2017 14:36:55 -0700 Subject: [PATCH] qcacld-3.0: Add check for firmware message length Add check for buffer size in function wma_encrypt_decrypt_msg_handler Change-Id: I6dbead1d4996c5128cadc3ef071540fa0694201e CRs-Fixed: 2119060 --- core/wma/src/wma_features.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/core/wma/src/wma_features.c b/core/wma/src/wma_features.c index 7d6cb07ae8f3..1152cdadce4a 100644 --- a/core/wma/src/wma_features.c +++ b/core/wma/src/wma_features.c @@ -5125,6 +5125,14 @@ int wma_encrypt_decrypt_msg_handler(void *handle, uint8_t *data, encrypt_decrypt_rsp_params.vdev_id = data_event->vdev_id; encrypt_decrypt_rsp_params.status = data_event->status; + + if (data_event->data_length > param_buf->num_enc80211_frame) { + WMA_LOGE("FW msg data_len %d more than TLV hdr %d", + data_event->data_length, + param_buf->num_enc80211_frame); + return -EINVAL; + } + encrypt_decrypt_rsp_params.data_length = data_event->data_length; if (encrypt_decrypt_rsp_params.data_length) {