A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-23 13:09:04 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Avoid possible buffer overwrite in wma_process_utf_event

Browse source 
Check for the maximum allowed data that can be written into
the buffer utf_event_info.data in the function
wma_process_utf_event.

Change-Id: I9ee37470b7a3e7016941f871d3cf73eb12718758
CRs-Fixed: 2115375
This commit is contained in:
Varun Reddy Yeturu 2017-09-26 15:28:42 -07:00 • committed by snandini
commit d4c523d673
1 changed files with 7 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
core/wma/src/wma_utils.c
View file

@ -4051,6 +4051,13 @@ wma_process_utf_event(WMA_HANDLE handle, uint8_t *datap, uint32_t dataplen)
currentSeq);
}
if ((datalen > MAX_UTF_EVENT_LENGTH) ||
(wma_handle->utf_event_info.offset >
(MAX_UTF_EVENT_LENGTH - datalen))) {
WMA_LOGE("Excess data from firmware, offset:%zu, len:%d",
wma_handle->utf_event_info.offset, datalen);
return -EINVAL;
}
memcpy(&wma_handle->utf_event_info.
data[wma_handle->utf_event_info.offset],
&data[sizeof(segHdrInfo)], datalen);