A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-14 16:46:15 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix chain_stats memory illegal access

Browse source 
chain_stats in WMI_UPDATE_STATS_EVENTID_param_tlvs may be set as
NULL by wlan firmware.

When access chain_stats, make sure it is not NULL.

Change-Id: I3a78534899a3a56f378c4825ff5b8abedb543b8c
CRs-Fixed: 2102247
This commit is contained in:
bings 2017-08-31 08:05:54 +08:00 • committed by snandini
commit f904765f82
1 changed files with 10 additions and 8 deletions
Download patch file Download diff file Expand all files Collapse all files

18
core/wma/src/wma_utils.c
View file

@ -2942,14 +2942,16 @@ int wma_stats_event_handler(void *handle, uint8_t *cmd_param_info,
rssi_event =
(wmi_per_chain_rssi_stats *) param_buf->chain_stats;
if (rssi_event && (rssi_event->num_per_chain_rssi_stats >
((WMI_SVC_MSG_MAX_SIZE - sizeof(*event)) /
sizeof(*peer_stats)))) {
excess_data = true;
break;
} else {
buf_len += rssi_event->num_per_chain_rssi_stats *
sizeof(*peer_stats);
if (rssi_event) {
if (rssi_event->num_per_chain_rssi_stats >
((WMI_SVC_MSG_MAX_SIZE - sizeof(*event)) /
sizeof(*rssi_event))) {
excess_data = true;
break;
} else {
buf_len += sizeof(*rssi_event) *
rssi_event->num_per_chain_rssi_stats;
}
}
} while (0);