From baca2a3950a63e692fffc98e2066f8976274fa7c Mon Sep 17 00:00:00 2001 From: sheenam monga Date: Wed, 8 Jul 2020 18:59:26 +0530 Subject: [PATCH] qcacld-3.0: Avoid OOB access of weight_list Currently, function mlme_is_freq_present_in_list calculates index based on chanel frequency in a loop of num_freq. But acs_weight array can hold NUM_CHANNELS number of values. loop index more than NUM_CHANNELS may lead to OOB read issue. Fix is to add a validation for loop index < NUM_CHANNELS to avoid any OOB issue. Change-Id: I3c1d3393cd2a40147c325fea8f76b1db1a51f457 CRs-Fixed: 2727312 --- components/mlme/core/src/wlan_mlme_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/components/mlme/core/src/wlan_mlme_main.c b/components/mlme/core/src/wlan_mlme_main.c index ed97f44601e1..db02ae773a71 100644 --- a/components/mlme/core/src/wlan_mlme_main.c +++ b/components/mlme/core/src/wlan_mlme_main.c @@ -1236,7 +1236,7 @@ mlme_is_freq_present_in_list(struct acs_weight *normalize_weight_chan_list, { uint8_t i; - for (i = 0; i < num_freq; i++) { + for (i = 0; i < num_freq && i < NUM_CHANNELS; i++) { if (normalize_weight_chan_list[i].chan_freq == freq) { *index = i; return true; @@ -1292,7 +1292,7 @@ mlme_acs_parse_weight_list(struct wlan_objmgr_psoc *psoc, } else { sscanf(str1, "%d", &freq1); strsep(&str1, "="); - if (!str1) + if (!str1 || !weight_list) goto end; sscanf(str1, "%d", &normalize_factor); if (mlme_is_freq_present_in_list(weight_list,