A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-10 22:40:54 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Avoid OOB access of weight_list

Browse source 
Currently, function mlme_is_freq_present_in_list calculates
index based on chanel frequency in a loop of num_freq.
But acs_weight array can hold NUM_CHANNELS number of values.
loop index more than NUM_CHANNELS may lead to OOB read issue.

Fix is to add a validation for loop index < NUM_CHANNELS to
avoid any OOB issue.

Change-Id: I3c1d3393cd2a40147c325fea8f76b1db1a51f457
CRs-Fixed: 2727312
This commit is contained in:
sheenam monga 2020-07-08 18:59:26 +05:30 • committed by nshrivas
commit baca2a3950
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
components/mlme/core/src/wlan_mlme_main.c
View file

@ -1236,7 +1236,7 @@ mlme_is_freq_present_in_list(struct acs_weight *normalize_weight_chan_list,
{
uint8_t i;
for (i = 0; i < num_freq; i++) {
for (i = 0; i < num_freq && i < NUM_CHANNELS; i++) {
if (normalize_weight_chan_list[i].chan_freq == freq) {
*index = i;
return true;
@ -1292,7 +1292,7 @@ mlme_acs_parse_weight_list(struct wlan_objmgr_psoc *psoc,
} else {
sscanf(str1, "%d", &freq1);
strsep(&str1, "=");
if (!str1)
if (!str1 || !weight_list)
goto end;
sscanf(str1, "%d", &normalize_factor);
if (mlme_is_freq_present_in_list(weight_list,