A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-15 01:01:56 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: Fix out-of-bounds write in htc_add_receive_pkt_multiple

Browse source 
In htc_add_receive_pkt_multiple, out-of-bounds write to a buffer.
Fix by checking the endpoint against the max endpoint.

Change-Id: Iaa82c7e8f3ae59f007380a7697959dd79dfb81ed
CRs-Fixed: 2232836
This commit is contained in:
Yun Park 2018-06-05 12:06:27 -07:00 • committed by nshrivas
commit ed2a224ba2
1 changed files with 4 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

5
htc/htc_recv.c
View file

@ -518,7 +518,10 @@ A_STATUS htc_add_receive_pkt_multiple(HTC_HANDLE HTCHandle,
return A_EINVAL;
}
AR_DEBUG_ASSERT(pFirstPacket->Endpoint < ENDPOINT_MAX);
if (pFirstPacket->Endpoint >= ENDPOINT_MAX) {
A_ASSERT(false);
return A_EINVAL;
}
AR_DEBUG_PRINTF(ATH_DEBUG_RECV,
("+- htc_add_receive_pkt_multiple : endPointId: %d, cnt:%d, length: %d\n",