From c31391065e4367a7c6284a4dde6addef1d06f363 Mon Sep 17 00:00:00 2001 From: Varun Reddy Yeturu Date: Wed, 27 Sep 2017 20:38:39 -0700 Subject: [PATCH] qcacld-3.0: Avoid int overflow in wma_unified_link_radio_stats_event_handler Check for the validity of the number of channels passed in the radio stats event received from firmware to ensure an integer overflow does not happen. Change-Id: Idf5738a40139aafad4de422965dc4ff3d0e53a32 CRs-Fixed: 2114426 --- core/wma/src/wma_utils.c | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/core/wma/src/wma_utils.c b/core/wma/src/wma_utils.c index cebd5c40a86b..d29365c89c60 100644 --- a/core/wma/src/wma_utils.c +++ b/core/wma/src/wma_utils.c @@ -66,6 +66,8 @@ #include "wmi_unified_param.h" #include "linux/ieee80211.h" #include +#include "cds_reg_service.h" + /* MCS Based rate table */ /* HT MCS parameters with Nss = 1 */ static struct index_data_rate_type mcs_nss1[] = { @@ -1518,9 +1520,21 @@ static int wma_unified_link_radio_stats_event_handler(void *handle, WMA_LOGA("%s: Invalid param_tlvs for Radio Stats", __func__); return -EINVAL; } + if (radio_stats->num_channels > + (NUM_24GHZ_CHANNELS + NUM_5GHZ_CHANNELS)) { + WMA_LOGE("%s: Too many channels %d", + __func__, radio_stats->num_channels); + return -EINVAL; + } radio_stats_size = sizeof(tSirWifiRadioStat); chan_stats_size = sizeof(tSirWifiChannelStats); + if (fixed_param->num_radio > + (UINT_MAX - sizeof(*link_stats_results))/radio_stats_size) { + WMA_LOGE("excess num_radio %d is leading to int overflow", + fixed_param->num_radio); + return -EINVAL; + } link_stats_results_size = sizeof(*link_stats_results) + fixed_param->num_radio * radio_stats_size;