From 9d56e3a4c046cd1bc0d20bb0c07d0bacad2d1da9 Mon Sep 17 00:00:00 2001 From: Ryan Hsu Date: Wed, 6 Jun 2018 16:20:05 -0700 Subject: [PATCH] qcacmn: sanitize the range of local_id before using it Sanitize the local_id before accessing to the local_peer_ids pool. Change-Id: I5cd2f19d493360d384de895dccfaf51d3008b5b7 CRs-fixed: 2247672 --- dp/wifi3.0/dp_peer.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/dp/wifi3.0/dp_peer.c b/dp/wifi3.0/dp_peer.c index d947e46be1f9..ff2dee7688f6 100644 --- a/dp/wifi3.0/dp_peer.c +++ b/dp/wifi3.0/dp_peer.c @@ -2024,6 +2024,11 @@ void *dp_peer_find_by_local_id(struct cdp_pdev *pdev_handle, uint8_t local_id) struct dp_peer *peer; struct dp_pdev *pdev = (struct dp_pdev *)pdev_handle; + if (local_id >= OL_TXRX_NUM_LOCAL_PEER_IDS) { + DP_TRACE(DEBUG, "Incorrect local id %d", local_id); + QDF_BUG(0); + return NULL; + } qdf_spin_lock_bh(&pdev->local_peer_ids.lock); peer = pdev->local_peer_ids.map[local_id]; qdf_spin_unlock_bh(&pdev->local_peer_ids.lock);