From 9051736a2e9d1693d36973ab8e6d7f064446c013 Mon Sep 17 00:00:00 2001 From: Rakshith Suresh Patkar Date: Fri, 25 May 2018 14:09:10 +0530 Subject: [PATCH] qcacld-3.0: Fix possible overflow in wma_stats_event_handler The excess buffer check in wma_stats_event_handler is such that if buflen is greater than WMI_SVC_MSG_MAX_SIZE, the resulting difference of the two values will be a negative integer, which will be treated as a very large positive integer since the data type is unsigned. This will result in the check failing to detect overflow when compared with sizeof(*event). Fix the buflen check condition such that buflen is compared with the difference of WMI_SVC_MSG_MAX_SIZE and sizeof(*event), eliminating the possibility of overflow. Change-Id: Ic20bfa554476db36e28557402cec23fcce5af85d CRs-Fixed: 2224443 --- core/wma/src/wma_utils.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/wma/src/wma_utils.c b/core/wma/src/wma_utils.c index fffa0dfa28ac..ee2f4768529a 100644 --- a/core/wma/src/wma_utils.c +++ b/core/wma/src/wma_utils.c @@ -3095,7 +3095,7 @@ int wma_stats_event_handler(void *handle, uint8_t *cmd_param_info, } while (0); if (excess_data || - (sizeof(*event) > WMI_SVC_MSG_MAX_SIZE - buf_len)) { + (buf_len > WMI_SVC_MSG_MAX_SIZE - sizeof(*event))) { WMA_LOGE("excess wmi buffer: stats pdev %d vdev %d peer %d", event->num_pdev_stats, event->num_vdev_stats, event->num_peer_stats);