A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-24 13:44:26 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Avoid int overflow in wma_unified_link_radio_stats_event_handler

Browse source 
Check for the validity of the number of channels passed in the
radio stats event received from firmware to ensure an integer
overflow does not happen.

Change-Id: Idf5738a40139aafad4de422965dc4ff3d0e53a32
CRs-Fixed: 2114426
This commit is contained in:
Varun Reddy Yeturu 2017-09-27 20:38:39 -07:00
commit c31391065e
1 changed files with 14 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

14
core/wma/src/wma_utils.c
View file

@ -66,6 +66,8 @@
#include "wmi_unified_param.h"
#include "linux/ieee80211.h"
#include <cdp_txrx_handle.h>
#include "cds_reg_service.h"
/* MCS Based rate table */
/* HT MCS parameters with Nss = 1 */
static struct index_data_rate_type mcs_nss1[] = {
@ -1518,9 +1520,21 @@ static int wma_unified_link_radio_stats_event_handler(void *handle,
WMA_LOGA("%s: Invalid param_tlvs for Radio Stats", __func__);
return -EINVAL;
}
if (radio_stats->num_channels >
(NUM_24GHZ_CHANNELS + NUM_5GHZ_CHANNELS)) {
WMA_LOGE("%s: Too many channels %d",
__func__, radio_stats->num_channels);
return -EINVAL;
}
radio_stats_size = sizeof(tSirWifiRadioStat);
chan_stats_size = sizeof(tSirWifiChannelStats);
if (fixed_param->num_radio >
(UINT_MAX - sizeof(*link_stats_results))/radio_stats_size) {
WMA_LOGE("excess num_radio %d is leading to int overflow",
fixed_param->num_radio);
return -EINVAL;
}
link_stats_results_size = sizeof(*link_stats_results) +
fixed_param->num_radio * radio_stats_size;