From e2e7af2eafb95ffc22a06fd303281c3929b326b7 Mon Sep 17 00:00:00 2001 From: chunquan Date: Fri, 25 Feb 2022 10:10:32 +0800 Subject: [PATCH] qcacmn: Fetch thermal_stats in array range Since lvl_idx maybe get value large than param_buf->num_temp_range_stats, then out of bounds will happen when read array of wmi_tt_stats. Change-Id: I85b29216272952102dca41792c290baf285a8e31 CRs-Fixed: 3136333 --- wmi/src/wmi_unified_tlv.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/wmi/src/wmi_unified_tlv.c b/wmi/src/wmi_unified_tlv.c index 8e72ec1519df..5ee0bf55b03d 100644 --- a/wmi/src/wmi_unified_tlv.c +++ b/wmi/src/wmi_unified_tlv.c @@ -11500,6 +11500,13 @@ populate_thermal_stats(WMI_THERM_THROT_STATS_EVENTID_param_tlvs *param_buf, WMI_THERMAL_STATS_TEMP_THRESH_LEVEL_MAX : tt_stats_event->therm_throt_levels; + if (*therm_throt_levels > param_buf->num_temp_range_stats) { + wmi_err("therm_throt_levels:%u oob num_temp_range_stats:%u", + *therm_throt_levels, + param_buf->num_temp_range_stats); + return; + } + wmi_tt_stats = param_buf->temp_range_stats; if (!wmi_tt_stats) { wmi_err("wmi_tt_stats Null");