From 88e5800271dc637f8089f3d4c2ecf6eeaf978d95 Mon Sep 17 00:00:00 2001 From: lifeng Date: Mon, 1 Apr 2019 12:09:32 +0800 Subject: [PATCH] qcacld-3.0: Validate cfgLength to the upper bound Validate cfgLength to the upper bound before using it in copy inside csr_get_cfg_max_tx_power()/lim_get_dot11d_transmit_power. Change-Id: Ibcc1f145db9b902a29a0332553323d0a3ac6b2ff CRs-Fixed: 2423707 --- core/mac/src/pe/lim/lim_utils.c | 4 ++++ core/sme/src/csr/csr_api_roam.c | 18 +++++++++++------- 2 files changed, 15 insertions(+), 7 deletions(-) diff --git a/core/mac/src/pe/lim/lim_utils.c b/core/mac/src/pe/lim/lim_utils.c index 5cc86de04efa..7c9376546050 100644 --- a/core/mac/src/pe/lim/lim_utils.c +++ b/core/mac/src/pe/lim/lim_utils.c @@ -8221,10 +8221,14 @@ lim_get_dot11d_transmit_power(struct mac_context *mac, uint8_t channel) goto error; if (WLAN_REG_IS_5GHZ_CH(channel)) { + if (cfg_length > CFG_MAX_TX_POWER_5_LEN) + goto error; qdf_mem_copy(country_info, mac->mlme_cfg->power.max_tx_power_5.data, cfg_length); } else if (WLAN_REG_IS_24GHZ_CH(channel)) { + if (cfg_length > CFG_MAX_TX_POWER_2_4_LEN) + goto error; qdf_mem_copy(country_info, mac->mlme_cfg->power.max_tx_power_24.data, cfg_length); diff --git a/core/sme/src/csr/csr_api_roam.c b/core/sme/src/csr/csr_api_roam.c index 923be4eb1825..6062b9547fc5 100644 --- a/core/sme/src/csr/csr_api_roam.c +++ b/core/sme/src/csr/csr_api_roam.c @@ -13147,7 +13147,7 @@ QDF_STATUS csr_get_cfg_valid_channels(struct mac_context *mac, uint8_t *pChannel int8_t csr_get_cfg_max_tx_power(struct mac_context *mac, uint8_t channel) { - uint32_t cfgLength = 0; + uint32_t cfg_length = 0; int8_t maxTxPwr = 0; uint8_t *pCountryInfo = NULL; uint8_t count = 0; @@ -13155,29 +13155,33 @@ int8_t csr_get_cfg_max_tx_power(struct mac_context *mac, uint8_t channel) uint8_t maxChannels; if (WLAN_REG_IS_5GHZ_CH(channel)) { - cfgLength = mac->mlme_cfg->power.max_tx_power_5.len; + cfg_length = mac->mlme_cfg->power.max_tx_power_5.len; } else if (WLAN_REG_IS_24GHZ_CH(channel)) { - cfgLength = mac->mlme_cfg->power.max_tx_power_24.len; + cfg_length = mac->mlme_cfg->power.max_tx_power_24.len; } else return maxTxPwr; - pCountryInfo = qdf_mem_malloc(cfgLength); + pCountryInfo = qdf_mem_malloc(cfg_length); if (!pCountryInfo) goto error; if (WLAN_REG_IS_5GHZ_CH(channel)) { + if (cfg_length > CFG_MAX_TX_POWER_5_LEN) + goto error; qdf_mem_copy(pCountryInfo, mac->mlme_cfg->power.max_tx_power_5.data, - cfgLength); + cfg_length); } else if (WLAN_REG_IS_24GHZ_CH(channel)) { + if (cfg_length > CFG_MAX_TX_POWER_2_4_LEN) + goto error; qdf_mem_copy(pCountryInfo, mac->mlme_cfg->power.max_tx_power_24.data, - cfgLength); + cfg_length); } /* Identify the channel and maxtxpower */ - while (count <= (cfgLength - (sizeof(tSirMacChanInfo)))) { + while (count <= (cfg_length - (sizeof(tSirMacChanInfo)))) { firstChannel = pCountryInfo[count++]; maxChannels = pCountryInfo[count++]; maxTxPwr = pCountryInfo[count++];