A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-11 23:24:22 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix buffer overflow in wma radio_tx_power_level_stats handler

Browse source 
In function wma_unified_radio_tx_power_level_stats_event_handler,
power_level_offset is received from the FW and is used to memcpy data
from FW to local tx_time_per_power_level for num_tx_power_levels length.
However tx_time_per_power_level is allocated only for
total_num_tx_power_levels length.
If the power_level_offset is greater than total_num_tx_power_levels, then
a buffer overwrite would occur.

Add sanity check to make sure power_level_offset does not exceed
total_num_tx_power_levels

Change-Id: Ia363512ee35bb0e30b137c20bf092238c2e356da
CRs-Fixed: 2149501
This commit is contained in:
Vignesh Viswanathan 2017-11-28 16:58:24 +05:30 • committed by snandini
commit ad7eded05e
1 changed files with 13 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

14
core/wma/src/wma_utils.c
View file

@ -1484,9 +1484,9 @@ static int wma_unified_radio_tx_power_level_stats_event_handler(void *handle,
sizeof(*fixed_param)) / sizeof(uint32_t))) {
WMA_LOGE("%s: excess tx_power buffers:%d", __func__,
fixed_param->num_tx_power_levels);
QDF_ASSERT(0);
return -EINVAL;
}
rs_results = (tSirWifiRadioStat *) &link_stats_results->results[0] +
fixed_param->radio_id;
tx_power_level_values = (uint8_t *) param_tlvs->tx_time_per_power_level;
@ -1498,6 +1498,18 @@ static int wma_unified_radio_tx_power_level_stats_event_handler(void *handle,
goto post_stats;
}
if ((fixed_param->power_level_offset >
rs_results->total_num_tx_power_levels) ||
(fixed_param->num_tx_power_levels >
rs_results->total_num_tx_power_levels -
fixed_param->power_level_offset)) {
WMA_LOGE("%s: Invalid offset %d total_num %d num %d",
__func__, fixed_param->power_level_offset,
rs_results->total_num_tx_power_levels,
fixed_param->num_tx_power_levels);
return -EINVAL;
}
if (!rs_results->tx_time_per_power_level) {
rs_results->tx_time_per_power_level = qdf_mem_malloc(
sizeof(uint32_t) *