From f71b48e5051f8551536221ae9c9b8335a0ec436b Mon Sep 17 00:00:00 2001 From: Yeshwanth Sriram Guntuka Date: Fri, 20 Apr 2018 15:18:08 +0530 Subject: [PATCH] qcacld-3.0: Possible buffer overflow in wma_stats_ext_event_handler Check for stats ext info data len does not take TLV header size into account which could lead to buffer overflow when copying data where TLV header size is taken into account. Fix is to subtract TLV header size and stats_ext_info size from max allowed size when validating stats ext info data length. Change-Id: I34e35a0aab396af3d93a0f61e0ab6a2da09f22ab CRs-Fixed: 2227263 --- core/wma/src/wma_utils.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/core/wma/src/wma_utils.c b/core/wma/src/wma_utils.c index 48d7f51ff94f..a47582c14be6 100644 --- a/core/wma/src/wma_utils.c +++ b/core/wma/src/wma_utils.c @@ -452,8 +452,8 @@ int wma_stats_ext_event_handler(void *handle, uint8_t *event_buf, alloc_len += stats_ext_info->data_len; if (stats_ext_info->data_len > (WMI_SVC_MSG_MAX_SIZE - - sizeof(*stats_ext_info)) || stats_ext_info->data_len > - param_buf->num_data) { + WMI_TLV_HDR_SIZE - sizeof(*stats_ext_info)) || + stats_ext_info->data_len > param_buf->num_data) { WMA_LOGE("Excess data_len:%d, num_data:%d", stats_ext_info->data_len, param_buf->num_data); return -EINVAL;