From db8a58c97b00499b1412b92247fcec2e5f29997d Mon Sep 17 00:00:00 2001 From: Amar Singhal Date: Tue, 3 Oct 2017 13:00:29 -0700 Subject: [PATCH] qcacmn: Check for buffer overflow in event handler Check for buffer overflow in send_log_supported_evt_cmd_tlv. Change-Id: Ib4850ce1a7abb77025a0dc8a3cc9776f6550eb9e CRs-Fixed: 2122746 --- wmi/src/wmi_unified_tlv.c | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/wmi/src/wmi_unified_tlv.c b/wmi/src/wmi_unified_tlv.c index 1aaee3da8cd8..cba7618a7edf 100644 --- a/wmi/src/wmi_unified_tlv.c +++ b/wmi/src/wmi_unified_tlv.c @@ -11874,6 +11874,7 @@ send_mcast_group_update_cmd_tlv(wmi_unified_t wmi_handle, WMI_CHAR_ARRAY_TO_MAC_ADDR(param->ucast_mac_addr, &cmd->ucast_mac_addr); } + if (param->mcast_ip_addr) { QDF_ASSERT(param->mcast_ip_addr_bytes <= sizeof(cmd->mcast_ip_addr)); @@ -12784,6 +12785,15 @@ static QDF_STATUS send_log_supported_evt_cmd_tlv(wmi_unified_t wmi_handle, } wmi_event = param_buf->fixed_param; num_of_diag_events_logs = wmi_event->num_of_diag_events_logs; + + if (num_of_diag_events_logs > + param_buf->num_diag_events_logs_list) { + WMI_LOGE("message number of events %d is more than tlv hdr content %d", + num_of_diag_events_logs, + param_buf->num_diag_events_logs_list); + return QDF_STATUS_E_INVAL; + } + evt_args = param_buf->diag_events_logs_list; if (!evt_args) { WMI_LOGE("%s: Event list is empty, num_of_diag_events_logs=%d",