From ca67e368a26e7b84073efc4ea001e49bef2dbbde Mon Sep 17 00:00:00 2001
From: Vignesh Viswanathan <viswanat@codeaurora.org>
Date: Wed, 4 Oct 2017 23:42:00 +0530
Subject: [PATCH] qcacld-3.0: Add sanity check for total_peer_len in
 wma_get_ll_stats_ext_buf

Add additional sanity checks for total_peer_len in wma_get_ll_stats_ext_buf.
Missing changes for CLD3.2 from I2689873c2c5e63c83e5059563662c0c69dc659fc

Change-Id: I6f82c9ef251e0290f9cf68e9fcd2d8868a5a302c
CRs-Fixed: 2121194
---
 core/wma/src/wma_utils.c | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/core/wma/src/wma_utils.c b/core/wma/src/wma_utils.c
index e10193a95de9..eb59603cd0ce 100644
--- a/core/wma/src/wma_utils.c
+++ b/core/wma/src/wma_utils.c
@@ -767,9 +767,12 @@ static tSirLLStatsResults *wma_get_ll_stats_ext_buf(uint32_t *len,
 					 (sizeof(struct sir_wifi_tx) +
 					 sizeof(struct sir_wifi_rx)));
 		}
-		if (peer_num > (WMI_SVC_MSG_MAX_SIZE /
-				(sizeof(struct sir_wifi_ll_ext_peer_stats) +
-				total_peer_len))) {
+		if (total_peer_len > WMI_SVC_MSG_MAX_SIZE) {
+			excess_data = true;
+			break;
+		}
+		if (peer_num > (WMI_SVC_MSG_MAX_SIZE - total_peer_len) /
+				sizeof(struct sir_wifi_ll_ext_peer_stats)) {
 			excess_data = true;
 			break;
 		} else {