From ab08adcec0303906d40dd98451c14938b0f61a24 Mon Sep 17 00:00:00 2001 From: Dundi Raviteja Date: Tue, 12 Jun 2018 18:31:43 +0530 Subject: [PATCH] qcacld-3.0: OOB access may occur due to total numChannels exceeds max value Out of Buffer access may occur in wmi_get_buf_extscan_start_cmd() function if user provided inputs are different for below parameters which are assigned in hdd_extscan_start_fill_bucket_channel_spec() function 1. QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_NUM_CHANNEL_SPECS 2. QCA_WLAN_VENDOR_ATTR_EXTSCAN_CHANNEL_SPEC To address this issue return failure status if numChannels is not equal to the total number of channel entries. Change-Id: I60d74161dc3752bd7f609af3910d7c86a99488ec CRs-Fixed: 2255189 --- core/hdd/src/wlan_hdd_ext_scan.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/core/hdd/src/wlan_hdd_ext_scan.c b/core/hdd/src/wlan_hdd_ext_scan.c index c3b05cab0f5d..e0c890733a34 100644 --- a/core/hdd/src/wlan_hdd_ext_scan.c +++ b/core/hdd/src/wlan_hdd_ext_scan.c @@ -3042,6 +3042,11 @@ static int hdd_extscan_start_fill_bucket_channel_spec( total_channels++; } + if (j != req_msg->buckets[bkt_index].numChannels) { + hdd_err("Input parameters didn't match"); + return -EINVAL; + } + hdd_extscan_update_dwell_time_limits( req_msg, bkt_index, min_dwell_time_active_bucket,