From d3201dd0858e4e86c7fa661ba34b9858e70ad31a Mon Sep 17 00:00:00 2001 From: Sandeep Puligilla Date: Mon, 4 Feb 2019 13:10:58 -0800 Subject: [PATCH] qcacld-3.0: Add check for bss_list size in wma_group_num_bss_to_scan_id In wma_group_num_bss_to_scan_id(), bssid_list may get accessed outside of the available buffer size. Fix the possible out of boundary access by adding a check. Change-Id: I5e278bd96b8f57c96f53d7c3cd8f4f3e5a67fc6c CRs-Fixed: 2385431 --- core/wma/src/wma_scan_roam.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/core/wma/src/wma_scan_roam.c b/core/wma/src/wma_scan_roam.c index 7bb88c5bdd04..faefda3e3892 100644 --- a/core/wma/src/wma_scan_roam.c +++ b/core/wma/src/wma_scan_roam.c @@ -4131,6 +4131,17 @@ static int wma_group_num_bss_to_scan_id(const u_int8_t *cmd_param_info, t_cached_result = cached_result; t_scan_id_grp = &t_cached_result->result[0]; + if ((t_cached_result->num_scan_ids * + QDF_MIN(t_scan_id_grp->num_results, + param_buf->num_bssid_list)) > param_buf->num_bssid_list) { + WMA_LOGE("%s:num_scan_ids %d, num_results %d num_bssid_list %d", + __func__, + t_cached_result->num_scan_ids, + t_scan_id_grp->num_results, + param_buf->num_bssid_list); + return -EINVAL; + } + WMA_LOGD("%s: num_scan_ids:%d", __func__, t_cached_result->num_scan_ids); for (i = 0; i < t_cached_result->num_scan_ids; i++) {