A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-11 07:03:09 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Avoid possible buffer over-read in wma_wow_wakeup_host_event

Browse source 
Check for the minimum allowed data that can be written into
the buffer param_buf->num_wow_packet_buffer in the functions
wma_wake_event_packet and wma_wake_event_piggybacked.

Change-Id: I8b83bc973fd6f0d7ad9e421a387ce3f03d6b6939
CRs-Fixed: 2161027
This commit is contained in:
Abhinav Kumar 2018-01-24 16:15:30 +05:30 • committed by snandini
commit b0f9956700
1 changed files with 10 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

11
core/wma/src/wma_features.c
View file

@ -2564,6 +2564,11 @@ static int wma_wake_event_packet(
uint8_t *packet;
uint32_t packet_len;
if (event_param->num_wow_packet_buffer <= 4) {
WMA_LOGE("Invalid wow packet buffer from firmware %u",
event_param->num_wow_packet_buffer);
return -EINVAL;
}
/* first 4 bytes are the length, followed by the buffer */
packet_len = *(uint32_t *)event_param->wow_packet_buffer;
packet = event_param->wow_packet_buffer + 4;
@ -2653,8 +2658,12 @@ static int wma_wake_event_piggybacked(
* piggybacked event is empty. In these cases we just want to wake up,
* and no action is needed. Bail out now if that is the case.
*/
if (!event_param->wow_packet_buffer)
if (!event_param->wow_packet_buffer ||
event_param->num_wow_packet_buffer <= 4) {
WMA_LOGE("Invalid wow packet buffer from firmware %u",
event_param->num_wow_packet_buffer);
return 0;
}
wake_reason = event_param->fixed_param->wake_reason;