From d2967a742c4fd97072932bb9f5be654ff0808905 Mon Sep 17 00:00:00 2001 From: gaurank kathpalia Date: Tue, 1 May 2018 12:35:14 +0530 Subject: [PATCH] qcacld-3.0: Fix OOB write in vdev_mac_map In the API wma_process_pdev_hw_mode_trans_ind the host doesnt check the upper limit of num_vdev_mac_entries received from the firmware, and fills the same to the host structure hw_mode_trans_ind, which may cause OOB write. Fix is to check for the max vdev supported in the same API and return if the condition is false. Change-Id: I54a9e12f777b87b49057d6c97c06ab71b9ad1d77 CRs-Fixed: 2221965 --- core/wma/src/wma_main.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/core/wma/src/wma_main.c b/core/wma/src/wma_main.c index eaa8616a88b2..8340e5a3dc31 100644 --- a/core/wma/src/wma_main.c +++ b/core/wma/src/wma_main.c @@ -3886,7 +3886,13 @@ void wma_process_pdev_hw_mode_trans_ind(void *handle, { uint32_t i; tp_wma_handle wma = (tp_wma_handle) handle; - + if (fixed_param->num_vdev_mac_entries > MAX_VDEV_SUPPORTED) { + WMA_LOGE("Number of Vdev mac entries %d exceeded" + " max vdev supported %d", + fixed_param->num_vdev_mac_entries, + MAX_VDEV_SUPPORTED); + return; + } hw_mode_trans_ind->old_hw_mode_index = fixed_param->old_hw_mode_index; hw_mode_trans_ind->new_hw_mode_index = fixed_param->new_hw_mode_index; hw_mode_trans_ind->num_vdev_mac_entries =