From a1539d3e22e27c59ac8a511e8b141a21498bbb77 Mon Sep 17 00:00:00 2001
From: Himanshu Agarwal <himanaga@codeaurora.org>
Date: Wed, 11 Oct 2017 18:08:56 +0530
Subject: [PATCH] qcacld-3.0: Add sanity check for num_hw_modes and num_phy

Add sanity check for num_hw_modes and num_phy in wma_populate_soc_caps()
for WMI_SERVICE_READY_EXT_EVENTID.

Change-Id: I023d737449283f9ac092d278bde016b208b2c891
CRs-Fixed: 2119887
---
 core/wma/inc/wma_internal.h |  3 +++
 core/wma/src/wma_main.c     | 15 +++++++++++++++
 2 files changed, 18 insertions(+)

diff --git a/core/wma/inc/wma_internal.h b/core/wma/inc/wma_internal.h
index 356a6fb839e6..cb8e1c0c1d45 100644
--- a/core/wma/inc/wma_internal.h
+++ b/core/wma/inc/wma_internal.h
@@ -118,6 +118,9 @@
 /* Time(in ms) to detect DOS attack */
 #define WMA_MGMT_FRAME_DETECT_DOS_TIMER 1000
 
+#define MAX_NUM_HW_MODE    0xff
+#define MAX_NUM_PHY        0xff
+
 /**
  * struct index_data_rate_type - non vht data rate type
  * @mcs_index: mcs rate index
diff --git a/core/wma/src/wma_main.c b/core/wma/src/wma_main.c
index 89a16494e3be..a38ec6f60f27 100644
--- a/core/wma/src/wma_main.c
+++ b/core/wma/src/wma_main.c
@@ -5807,6 +5807,13 @@ static void wma_populate_soc_caps(t_wma_handle *wma_handle,
 		return;
 	}
 
+	if (param_buf->soc_hw_mode_caps->num_hw_modes >
+			MAX_NUM_HW_MODE) {
+		WMA_LOGE("Invalid num_hw_modes %u received from firmware",
+			 param_buf->soc_hw_mode_caps->num_hw_modes);
+		return;
+	}
+
 	qdf_mem_copy(&phy_caps->num_hw_modes,
 			param_buf->soc_hw_mode_caps,
 			sizeof(WMI_SOC_MAC_PHY_HW_MODE_CAPS));
@@ -5881,6 +5888,14 @@ static void wma_populate_soc_caps(t_wma_handle *wma_handle,
 	/*
 	 * next thing is to populate reg caps per phy
 	 */
+
+	if (param_buf->soc_hal_reg_caps->num_phy >
+			MAX_NUM_PHY) {
+		WMA_LOGE("Invalid num_phy %u received from firmware",
+			 param_buf->soc_hal_reg_caps->num_phy);
+		return;
+	}
+
 	qdf_mem_copy(&phy_caps->num_phy_for_hal_reg_cap,
 			param_buf->soc_hal_reg_caps,
 			sizeof(WMI_SOC_HAL_REG_CAPABILITIES));