A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-14 08:36:12 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: Fix OOB in extract_service_ready_ext_tlv()

Browse source 
num_chainmask_tables used as a for loop variable in
extract_service_ready_ext_tlv(), is never bound check
and may lead to OOB.

Change-Id: Ib0fdde8386fc372abee44934e10e9f54b0fe25b8
CRS-Fixed: 2330943
This commit is contained in:
Harprit Chhabada 2018-10-18 13:27:56 -07:00 • committed by nshrivas
commit d063d7486c
1 changed files with 7 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
wmi/src/wmi_unified_tlv.c
View file

@ -9004,6 +9004,13 @@ static QDF_STATUS extract_service_ready_ext_tlv(wmi_unified_t wmi_handle,
} else
param->num_chainmask_tables = 0;
if (param->num_chainmask_tables > PSOC_MAX_CHAINMASK_TABLES ||
param->num_chainmask_tables >
param_buf->num_mac_phy_chainmask_combo) {
wmi_err_rl("num_chainmask_tables is OOB: %u",
param->num_chainmask_tables);
return QDF_STATUS_E_INVAL;
}
chain_mask_combo = param_buf->mac_phy_chainmask_combo;
if (chain_mask_combo == NULL)