From cda1c9977721eb7a9419ee5288e1cf1fe15518ea Mon Sep 17 00:00:00 2001
From: abhinav kumar <abhikuma@codeaurora.org>
Date: Fri, 4 Jun 2021 19:45:08 +0530
Subject: [PATCH] qcacld-3.0: Possible buffer overflow issue in wma

Possible bufer overflow risk in function
wmi_unified_bcn_tmpl_send.

Validate the beacon template length against
WMI_BEACON_TX_BUFFER_SIZE length to avoid overflow.

Change-Id: I98665de677f314f30a57991f48191f847718740c
CRs-Fixed: 2960714
---
 core/wma/src/wma_mgmt.c | 16 +++++++++++++++-
 1 file changed, 15 insertions(+), 1 deletion(-)

diff --git a/core/wma/src/wma_mgmt.c b/core/wma/src/wma_mgmt.c
index 0395cc145258..06b4165bb58a 100644
--- a/core/wma/src/wma_mgmt.c
+++ b/core/wma/src/wma_mgmt.c
@@ -2004,8 +2004,22 @@ static QDF_STATUS wma_unified_bcn_tmpl_send(tp_wma_handle wma,
 		tmpl_len = *(uint32_t *) &bcn_info->beacon[0];
 	else
 		tmpl_len = bcn_info->beaconLength;
-	if (p2p_ie_len)
+
+	if (tmpl_len > WMI_BEACON_TX_BUFFER_SIZE) {
+		wma_err("tmpl_len: %d > %d. Invalid tmpl len", tmpl_len,
+			WMI_BEACON_TX_BUFFER_SIZE);
+		return -EINVAL;
+	}
+
+	if (p2p_ie_len) {
+		if (tmpl_len <= p2p_ie_len) {
+			wma_err("tmpl_len %d <= p2p_ie_len %d, Invalid",
+				tmpl_len, p2p_ie_len);
+			return -EINVAL;
+		}
 		tmpl_len -= (uint32_t) p2p_ie_len;
+	}
+
 	frm = bcn_info->beacon + bytes_to_strip;
 	tmpl_len_aligned = roundup(tmpl_len, sizeof(A_UINT32));
 	/*