A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-12 07:37:31 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: Fix possible OOB access while sending ext stats request

Browse source 
In 32-bit systems, currently there is possible oob access in
send_stats_ext_req_cmd_tlv() is preq->request_data_len is
uin32_t max and len is also of type uint32_t.

Fix possible OOB access while sending ext stats request message
to firmware by validating the requested data length against the
difference between wmi max message size(WMI_SVC_MSG_MAX_SIZE),
size of the wmi command fixed param and wmi tlv header size
WMI_TLV_HDR_SIZE.

Change-Id: I769c9a6b7c0e0f76e2ec1070cac6c69768816454
CRs-Fixed: 2724256
This commit is contained in:
Pragaspathi Thilagaraj 2020-07-02 20:47:48 +05:30 • committed by snandini
commit 8fe9240f54
1 changed files with 8 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
wmi/src/wmi_unified_tlv.c
View file

@ -5920,6 +5920,14 @@ static QDF_STATUS send_stats_ext_req_cmd_tlv(wmi_unified_t wmi_handle,
wmi_buf_t buf;
size_t len;
uint8_t *buf_ptr;
uint16_t max_wmi_msg_size = wmi_get_max_msg_len(wmi_handle);
if (preq->request_data_len > (max_wmi_msg_size - WMI_TLV_HDR_SIZE -
sizeof(*cmd))) {
wmi_err("Data length=%d is greater than max wmi msg size",
preq->request_data_len);
return QDF_STATUS_E_FAILURE;
}
len = sizeof(*cmd) + WMI_TLV_HDR_SIZE + preq->request_data_len;