From c078394102af4007d88f05cca697d9a2fc92f6cd Mon Sep 17 00:00:00 2001 From: Manikandan Mohan Date: Thu, 4 Oct 2018 15:11:29 -0700 Subject: [PATCH] qcacmn: Fix out-of-bounds read in extract_ndp_confirm_tlv Update handling of WMI_NDP_CONFIRM_EVENTID for possible out of bounds read when fixed_params->num_ndp_channels is greater than TLV length of NDP channel list or NSS list Change-Id: I3bf429a47c46edbb464cf8447f227f7baa74fbe3 CRs-fixed: 2325849 --- wmi/src/wmi_unified_tlv.c | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/wmi/src/wmi_unified_tlv.c b/wmi/src/wmi_unified_tlv.c index 906d805bc890..265ecaca0580 100644 --- a/wmi/src/wmi_unified_tlv.c +++ b/wmi/src/wmi_unified_tlv.c @@ -15242,6 +15242,14 @@ static QDF_STATUS extract_ndp_confirm_tlv(wmi_unified_t wmi_handle, __func__, fixed_params->ndp_app_info_len); return QDF_STATUS_E_INVAL; } + if (fixed_params->num_ndp_channels > event->num_ndp_channel_list || + fixed_params->num_ndp_channels > event->num_nss_list) { + WMI_LOGE(FL("NDP Ch count %d greater than NDP Ch TLV len (%d) or NSS TLV len (%d)"), + fixed_params->num_ndp_channels, + event->num_ndp_channel_list, + event->num_nss_list); + return QDF_STATUS_E_INVAL; + } rsp->vdev = wlan_objmgr_get_vdev_by_id_from_psoc(wmi_handle->soc->wmi_psoc,