A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-23 21:19:04 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Avoid integer overflow in wma_peer_info_event_handler

Browse source 
Check for the num_peers received from firmware and ensure an
integer overflow does not happen in wma_peer_info_event_handler.

Change-Id: I08cc98fc425d9905d0ca090cd42b73227e594772
CRs-Fixed: 2115366
This commit is contained in:
Varun Reddy Yeturu 2017-09-26 15:51:07 -07:00 • committed by snandini
commit e4e2f29d4b
1 changed files with 7 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
core/wma/src/wma_utils.c
View file

@ -3241,6 +3241,13 @@ int wma_peer_info_event_handler(void *handle, u_int8_t *cmd_param_info,
WMA_LOGI("%s Recv WMI_PEER_STATS_INFO_EVENTID", __func__);
event = param_buf->fixed_param;
if (event->num_peers >
((WMI_SVC_MSG_MAX_SIZE -
sizeof(wmi_peer_stats_info_event_fixed_param))/
sizeof(wmi_peer_stats_info))) {
WMA_LOGE("Excess num of peers from fw %d", event->num_peers);
return -EINVAL;
}
buf_size = sizeof(wmi_peer_stats_info_event_fixed_param) +
sizeof(wmi_peer_stats_info) * event->num_peers;
buf = qdf_mem_malloc(buf_size);