From e4c142d0d8a09facdeb486dce4cd5ae3481e989e Mon Sep 17 00:00:00 2001 From: Wu Gao Date: Tue, 6 Nov 2018 11:54:32 +0800 Subject: [PATCH] qcacld-3.0: Fix potential OOB read when dump dbs hw mode It doesn't update wma_handle->num_dbs_hw_modes after event WMI_SERVICE_READY_EXT_EVENTID comes and re-allocate hw_mode_list, which will cause potentially OOB read hw_mode_list. Change-Id: I8e4aa13120bfe185fba3e0000cf289406b6bcfce CRs-Fixed: 2336889 --- core/wma/src/wma_main.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/core/wma/src/wma_main.c b/core/wma/src/wma_main.c index ff8347388168..4fab81a27637 100644 --- a/core/wma/src/wma_main.c +++ b/core/wma/src/wma_main.c @@ -6470,12 +6470,15 @@ static QDF_STATUS wma_update_hw_mode_list(t_wma_handle *wma_handle, wma_handle->hw_mode.hw_mode_list = qdf_mem_malloc(sizeof(*wma_handle->hw_mode.hw_mode_list) * num_hw_modes); - if (!wma_handle->hw_mode.hw_mode_list) + if (!wma_handle->hw_mode.hw_mode_list) { + wma_handle->num_dbs_hw_modes = 0; return QDF_STATUS_E_FAILURE; + } WMA_LOGD("%s: Updated HW mode list: Num modes:%d", __func__, num_hw_modes); + wma_handle->num_dbs_hw_modes = num_hw_modes; for (i = 0; i < num_hw_modes; i++) { /* Update for MAC0 */ tmp = &mac_phy_cap[j++];