A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-24 05:29:04 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: Check for buffer overflow in event handler

Browse source 
Check for buffer overflow in send_log_supported_evt_cmd_tlv.

Change-Id: Ib4850ce1a7abb77025a0dc8a3cc9776f6550eb9e
CRs-Fixed: 2122746
This commit is contained in:
Amar Singhal 2017-10-03 13:00:29 -07:00 • committed by snandini
commit db8a58c97b
1 changed files with 10 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

10
wmi/src/wmi_unified_tlv.c
View file

@ -11874,6 +11874,7 @@ send_mcast_group_update_cmd_tlv(wmi_unified_t wmi_handle,
WMI_CHAR_ARRAY_TO_MAC_ADDR(param->ucast_mac_addr,
&cmd->ucast_mac_addr);
}
if (param->mcast_ip_addr) {
QDF_ASSERT(param->mcast_ip_addr_bytes <=
sizeof(cmd->mcast_ip_addr));
@ -12784,6 +12785,15 @@ static QDF_STATUS send_log_supported_evt_cmd_tlv(wmi_unified_t wmi_handle,
}
wmi_event = param_buf->fixed_param;
num_of_diag_events_logs = wmi_event->num_of_diag_events_logs;
if (num_of_diag_events_logs >
param_buf->num_diag_events_logs_list) {
WMI_LOGE("message number of events %d is more than tlv hdr content %d",
num_of_diag_events_logs,
param_buf->num_diag_events_logs_list);
return QDF_STATUS_E_INVAL;
}
evt_args = param_buf->diag_events_logs_list;
if (!evt_args) {
WMI_LOGE("%s: Event list is empty, num_of_diag_events_logs=%d",