From eef7a78199ef88de778a2537b6519bbf68cba0da Mon Sep 17 00:00:00 2001
From: Jianmin Zhu <jianminz@codeaurora.org>
Date: Wed, 6 Oct 2021 10:50:07 +0800
Subject: [PATCH] qcacld-3.0: Avoid possible array OOB

Add bound check before access array to avoid out of bound issue.
Separate array bound and duplicate check of 11a and 11b since they have
different length and type.

Change-Id: Icb9382cd42385339532518759de0f6137c5203bd
CRs-Fixed: 3051517
---
 core/mac/src/pe/lim/lim_assoc_utils.c | 52 ++++++++++++++-------------
 1 file changed, 27 insertions(+), 25 deletions(-)

diff --git a/core/mac/src/pe/lim/lim_assoc_utils.c b/core/mac/src/pe/lim/lim_assoc_utils.c
index 0b9af500c5b2..aef9152778b3 100644
--- a/core/mac/src/pe/lim/lim_assoc_utils.c
+++ b/core/mac/src/pe/lim/lim_assoc_utils.c
@@ -1599,7 +1599,7 @@ QDF_STATUS lim_populate_peer_rate_set(struct mac_context *mac,
 {
 	tSirMacRateSet tempRateSet;
 	tSirMacRateSet tempRateSet2;
-	uint32_t i, j, val, min, isArate = 0;
+	uint32_t i, j, val, min;
 	qdf_size_t val_len;
 	uint8_t aRateIndex = 0;
 	uint8_t bRateIndex = 0;
@@ -1663,22 +1663,6 @@ QDF_STATUS lim_populate_peer_rate_set(struct mac_context *mac,
 				min = j;
 			}
 		}
-		if (sirIsArate(tempRateSet.rate[min] & 0x7f)) {
-			isArate = 1;
-		} else if (sirIsBrate(tempRateSet.rate[min] & 0x7f)) {
-			isArate = 0;
-		} else {
-			pe_debug("%d is neither 11a nor 11b rate",
-				 tempRateSet.rate[min]);
-			tempRateSet.rate[min] = 0xff;
-			continue;
-		}
-		if (tempRateSet.rate[min] == pRates->llaRates[aRateIndex] ||
-		    tempRateSet.rate[min] == pRates->llbRates[bRateIndex]) {
-			pe_debug("Duplicate rate: %d", tempRateSet.rate[min]);
-			tempRateSet.rate[min] = 0xff;
-			continue;
-		}
 		/*
 		 * HAL needs to know whether the rate is basic rate or not,
 		 * as it needs to update the response rate table accordingly.
@@ -1687,15 +1671,33 @@ QDF_STATUS lim_populate_peer_rate_set(struct mac_context *mac,
 		 * response rate table whenever basic rate set is changed.
 		 */
 		if (basicOnly && !(tempRateSet.rate[min] & 0x80)) {
-			tempRateSet.rate[min] = 0xff;
-			continue;
+			pe_debug("Invalid basic rate");
+		} else if (sirIsArate(tempRateSet.rate[min] & 0x7f)) {
+			if (aRateIndex >= SIR_NUM_11A_RATES) {
+				pe_debug("OOB, aRateIndex: %d", aRateIndex);
+			} else if (aRateIndex >= 1 && (tempRateSet.rate[min] ==
+				   pRates->llaRates[aRateIndex - 1])) {
+				pe_debug("Duplicate 11a rate: %d",
+					 tempRateSet.rate[min]);
+			} else {
+				pRates->llaRates[aRateIndex++] =
+						tempRateSet.rate[min];
+			}
+		} else if (sirIsBrate(tempRateSet.rate[min] & 0x7f)) {
+			if (bRateIndex >= SIR_NUM_11B_RATES) {
+				pe_debug("OOB, bRateIndex: %d", bRateIndex);
+			} else if (bRateIndex >= 1 && (tempRateSet.rate[min] ==
+				   pRates->llbRates[bRateIndex - 1])) {
+				pe_debug("Duplicate 11b rate: %d",
+					 tempRateSet.rate[min]);
+			} else {
+				pRates->llbRates[bRateIndex++] =
+						tempRateSet.rate[min];
+			}
+		} else {
+			pe_debug("%d is neither 11a nor 11b rate",
+				 tempRateSet.rate[min]);
 		}
-		if (isArate && aRateIndex < SIR_NUM_11A_RATES)
-			pRates->llaRates[aRateIndex++] =
-					tempRateSet.rate[min];
-		else if (bRateIndex < SIR_NUM_11B_RATES)
-			pRates->llbRates[bRateIndex++] =
-					tempRateSet.rate[min];
 		tempRateSet.rate[min] = 0xff;
 	}