From fc5bbedd4ab9fd5239be8618afe714d39dd8de49 Mon Sep 17 00:00:00 2001 From: Vignesh Viswanathan Date: Thu, 23 Nov 2017 14:14:01 +0530 Subject: [PATCH] qcacld-3.0: Fix buffer overread in wma_extscan_hotlist_match_event_handler In function wma_extscan_hotlist_match_event_handler, numap and src_hotlist are received from the FW. src_hotlist is pointer to the hostist data and is looped for numap times and copied to the local buffer dest_hotlist. If the value of numap is not equal to the number of src_hotlist data present in the buffer, buffer overread would occur during memcpy. Add check to validate the len of the buffer received from the FW is not less than the size of fixparam struct + (numap * src_hostlist structure) Change-Id: I2dc596f91bc49ccf0327062aa6732cd072d52085 CRs-Fixed: 2139436 --- core/wma/src/wma_scan_roam.c | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/core/wma/src/wma_scan_roam.c b/core/wma/src/wma_scan_roam.c index 5988cdded2b1..14c1d9c76f07 100644 --- a/core/wma/src/wma_scan_roam.c +++ b/core/wma/src/wma_scan_roam.c @@ -4220,6 +4220,7 @@ int wma_extscan_hotlist_match_event_handler(void *handle, wmi_extscan_wlan_descriptor *src_hotlist; uint32_t numap; int j, ap_found = 0; + uint32_t buf_len; tpAniSirGlobal pMac = cds_get_context(QDF_MODULE_ID_PE); if (!pMac) { @@ -4249,6 +4250,16 @@ int wma_extscan_hotlist_match_event_handler(void *handle, __func__, numap); numap = WMA_EXTSCAN_MAX_HOTLIST_ENTRIES; } + + buf_len = sizeof(wmi_extscan_hotlist_match_event_fixed_param) + + (4 * sizeof(uint32_t)) + + (numap * sizeof(wmi_extscan_wlan_descriptor)); + + if (buf_len > len) { + WMA_LOGE("Invalid buf len from FW %d numap %d", len, numap); + return -EINVAL; + } + dest_hotlist = qdf_mem_malloc(sizeof(*dest_hotlist) + sizeof(*dest_ap) * numap); if (!dest_hotlist) {