From d4c523d673db9b86b49ec3849cf73ac0bb4f13d7 Mon Sep 17 00:00:00 2001
From: Varun Reddy Yeturu <varunreddy.yeturu@codeaurora.org>
Date: Tue, 26 Sep 2017 15:28:42 -0700
Subject: [PATCH] qcacld-3.0: Avoid possible buffer overwrite in
 wma_process_utf_event

Check for the maximum allowed data that can be written into
the buffer utf_event_info.data in the function
wma_process_utf_event.

Change-Id: I9ee37470b7a3e7016941f871d3cf73eb12718758
CRs-Fixed: 2115375
---
 core/wma/src/wma_utils.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/core/wma/src/wma_utils.c b/core/wma/src/wma_utils.c
index 3e3a301151c5..9010ac9c0a38 100644
--- a/core/wma/src/wma_utils.c
+++ b/core/wma/src/wma_utils.c
@@ -4051,6 +4051,13 @@ wma_process_utf_event(WMA_HANDLE handle, uint8_t *datap, uint32_t dataplen)
 				 currentSeq);
 	}
 
+	if ((datalen > MAX_UTF_EVENT_LENGTH) ||
+		(wma_handle->utf_event_info.offset >
+		(MAX_UTF_EVENT_LENGTH - datalen))) {
+		WMA_LOGE("Excess data from firmware, offset:%zu, len:%d",
+			wma_handle->utf_event_info.offset, datalen);
+		return -EINVAL;
+	}
 	memcpy(&wma_handle->utf_event_info.
 	       data[wma_handle->utf_event_info.offset],
 	       &data[sizeof(segHdrInfo)], datalen);