From 00392f394cb13cdbeea5149c37ca4ac89eb713d5 Mon Sep 17 00:00:00 2001
From: Radhika Sriram <radhsrir@codeaurora.org>
Date: Wed, 4 Apr 2018 19:04:49 +0530
Subject: [PATCH] qcacmn: Fix Access Array out of bound

Upper bound length check is performed for index
that is used to access the array elements.

Change-Id: Id39ef1bd0446ce71be4f74532f2a7650df1a5432
CRs-Fixed: 2218940
---
 umac/cmn_services/crypto/src/wlan_crypto_global_api.c | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/umac/cmn_services/crypto/src/wlan_crypto_global_api.c b/umac/cmn_services/crypto/src/wlan_crypto_global_api.c
index 4551cdbbd33e..f96cf7df76d9 100644
--- a/umac/cmn_services/crypto/src/wlan_crypto_global_api.c
+++ b/umac/cmn_services/crypto/src/wlan_crypto_global_api.c
@@ -550,6 +550,11 @@ QDF_STATUS wlan_crypto_setkey(struct wlan_objmgr_vdev *vdev,
 			uint16_t kid = req_key->keyix;
 			if (kid == WLAN_CRYPTO_KEYIX_NONE)
 				kid = 0;
+			if (kid >= WLAN_CRYPTO_MAXKEYIDX) {
+				qdf_print("%s[%d] invalid keyid %d \n",
+						  __func__, __LINE__, kid);
+				return QDF_STATUS_E_INVAL;
+			}
 			if (!crypto_priv->key[kid]) {
 				crypto_priv->key[kid]
 					= qdf_mem_malloc(
@@ -826,6 +831,11 @@ QDF_STATUS wlan_crypto_delkey(struct wlan_objmgr_vdev *vdev,
 
 	if (key_idx >= WLAN_CRYPTO_MAXKEYIDX) {
 		uint8_t igtk_idx = key_idx - WLAN_CRYPTO_MAXKEYIDX;
+		if (igtk_idx >= WLAN_CRYPTO_MAXIGTKKEYIDX) {
+			qdf_print("%s[%d] Igtk key invalid keyid %d\n",
+			__func__, __LINE__, igtk_idx);
+			return QDF_STATUS_E_INVAL;
+		}
 		key = crypto_priv->igtk_key[igtk_idx];
 		crypto_priv->igtk_key[igtk_idx] = NULL;
 		if (key)