From e4e2f29d4b9cf62003b246c947b3af4d8c51d37d Mon Sep 17 00:00:00 2001 From: Varun Reddy Yeturu Date: Tue, 26 Sep 2017 15:51:07 -0700 Subject: [PATCH] qcacld-3.0: Avoid integer overflow in wma_peer_info_event_handler Check for the num_peers received from firmware and ensure an integer overflow does not happen in wma_peer_info_event_handler. Change-Id: I08cc98fc425d9905d0ca090cd42b73227e594772 CRs-Fixed: 2115366 --- core/wma/src/wma_utils.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/core/wma/src/wma_utils.c b/core/wma/src/wma_utils.c index 9010ac9c0a38..cebd5c40a86b 100644 --- a/core/wma/src/wma_utils.c +++ b/core/wma/src/wma_utils.c @@ -3241,6 +3241,13 @@ int wma_peer_info_event_handler(void *handle, u_int8_t *cmd_param_info, WMA_LOGI("%s Recv WMI_PEER_STATS_INFO_EVENTID", __func__); event = param_buf->fixed_param; + if (event->num_peers > + ((WMI_SVC_MSG_MAX_SIZE - + sizeof(wmi_peer_stats_info_event_fixed_param))/ + sizeof(wmi_peer_stats_info))) { + WMA_LOGE("Excess num of peers from fw %d", event->num_peers); + return -EINVAL; + } buf_size = sizeof(wmi_peer_stats_info_event_fixed_param) + sizeof(wmi_peer_stats_info) * event->num_peers; buf = qdf_mem_malloc(buf_size);