From a89f7ed3a3d50fad1cfc7effa8a6476e73e01669 Mon Sep 17 00:00:00 2001 From: sheenam monga Date: Mon, 16 Mar 2020 11:53:23 +0530 Subject: [PATCH] qcacld-3.0: Validate number of bytes before memory allocation Currently, In function hdd_get_roam_scan_ch_cb memory is allocated for event response buffer for invalid len. Fix is to add a validation check for len before alloction of memory to avoid memory allocation for invalid len. Change-Id: I14cffdace868fc19358322c36dd2589d7845b8fa CRs-Fixed: 2640114 --- core/hdd/src/wlan_hdd_ioctl.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/core/hdd/src/wlan_hdd_ioctl.c b/core/hdd/src/wlan_hdd_ioctl.c index 2a02890867fe..d52fa725be10 100644 --- a/core/hdd/src/wlan_hdd_ioctl.c +++ b/core/hdd/src/wlan_hdd_ioctl.c @@ -4025,6 +4025,10 @@ void hdd_get_roam_scan_ch_cb(hdd_handle_t hdd_handle, */ if (!roam_ch->command_resp) { len = roam_ch->num_channels * sizeof(roam_ch->chan_list[0]); + if (!len) { + hdd_err("Invalid len"); + return; + } event = (uint8_t *)qdf_mem_malloc(len); if (!event) { hdd_err("Failed to alloc event response buf vdev_id: %d",