From e6b4912a81f76414897d6f44c9caa31305359e4f Mon Sep 17 00:00:00 2001
From: Himanshu Agarwal <himanaga@codeaurora.org>
Date: Fri, 13 Oct 2017 17:50:11 +0530
Subject: [PATCH] qcacld-3.0: Add sanity check for buf pkt len to prevent OOB
 access

Add sanity check for wow_buf_pkt_len in wma_wow_wakeup_host_event()
to avoid out of bound memory access.

Change-Id: Id3b0003aa366d9239739efe561f44eff1dceff5d
CRs-Fixed: 2119401
---
 core/wma/src/wma_features.c | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/core/wma/src/wma_features.c b/core/wma/src/wma_features.c
index 80d62024cd26..9cd27be8963a 100644
--- a/core/wma/src/wma_features.c
+++ b/core/wma/src/wma_features.c
@@ -2514,6 +2514,13 @@ static int wma_wake_event_packet(
 		return 0;
 	}
 
+	if (packet_len > (event_param->num_wow_packet_buffer - 4)) {
+		WMA_LOGE("Invalid packet_len from firmware, packet_len: %u, num_wow_packet_buffer: %u",
+			 packet_len,
+			 event_param->num_wow_packet_buffer);
+		return -EINVAL;
+	}
+
 	wake_info = event_param->fixed_param;
 
 	switch (wake_info->wake_reason) {
@@ -2600,6 +2607,12 @@ static int wma_wake_event_piggybacked(
 
 		/* first 4 bytes are the length, followed by the buffer */
 		pb_event_len = *(uint32_t *)event_param->wow_packet_buffer;
+		if (pb_event_len > (event_param->num_wow_packet_buffer - 4)) {
+			WMA_LOGE("Invalid pb_event_len from firmware, pb_event_len: %u, num_wow_packet_buffer: %u",
+				 pb_event_len,
+				 event_param->num_wow_packet_buffer);
+			return -EINVAL;
+		}
 		pb_event_buf = event_param->wow_packet_buffer + 4;
 
 		WMA_LOGD("piggybacked event buffer:");