A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-13 08:07:32 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix OOB write in vdev_mac_map

Browse source 
In the API wma_process_pdev_hw_mode_trans_ind
the host doesnt check the upper limit of
num_vdev_mac_entries received from the firmware,
and fills the same to the host structure
hw_mode_trans_ind, which may cause OOB write.
Fix is to check for the max vdev supported in the
same API and return if the condition is false.

Change-Id: I54a9e12f777b87b49057d6c97c06ab71b9ad1d77
CRs-Fixed: 2221965
This commit is contained in:
gaurank kathpalia 2018-05-01 12:35:14 +05:30 • committed by nshrivas
commit d2967a742c
1 changed files with 7 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

8
core/wma/src/wma_main.c
View file

@ -3886,7 +3886,13 @@ void wma_process_pdev_hw_mode_trans_ind(void *handle,
{
uint32_t i;
tp_wma_handle wma = (tp_wma_handle) handle;
if (fixed_param->num_vdev_mac_entries > MAX_VDEV_SUPPORTED) {
WMA_LOGE("Number of Vdev mac entries %d exceeded"
" max vdev supported %d",
fixed_param->num_vdev_mac_entries,
MAX_VDEV_SUPPORTED);
return;
}
hw_mode_trans_ind->old_hw_mode_index = fixed_param->old_hw_mode_index;
hw_mode_trans_ind->new_hw_mode_index = fixed_param->new_hw_mode_index;
hw_mode_trans_ind->num_vdev_mac_entries =