A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-23 21:19:04 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix potential OOB read when dump dbs hw mode

Browse source 
It doesn't update wma_handle->num_dbs_hw_modes after event
WMI_SERVICE_READY_EXT_EVENTID comes and re-allocate hw_mode_list,
which will cause potentially OOB read hw_mode_list.

Change-Id: I8e4aa13120bfe185fba3e0000cf289406b6bcfce
CRs-Fixed: 2336889
This commit is contained in:
Wu Gao 2018-11-06 11:54:32 +08:00 • committed by nshrivas
commit e4c142d0d8
1 changed files with 4 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

5
core/wma/src/wma_main.c
View file

@ -6470,12 +6470,15 @@ static QDF_STATUS wma_update_hw_mode_list(t_wma_handle *wma_handle,
wma_handle->hw_mode.hw_mode_list =
qdf_mem_malloc(sizeof(*wma_handle->hw_mode.hw_mode_list) *
num_hw_modes);
if (!wma_handle->hw_mode.hw_mode_list)
if (!wma_handle->hw_mode.hw_mode_list) {
wma_handle->num_dbs_hw_modes = 0;
return QDF_STATUS_E_FAILURE;
}
WMA_LOGD("%s: Updated HW mode list: Num modes:%d",
__func__, num_hw_modes);
wma_handle->num_dbs_hw_modes = num_hw_modes;
for (i = 0; i < num_hw_modes; i++) {
/* Update for MAC0 */
tmp = &mac_phy_cap[j++];