From ff17327ad5992a10a2f6e167d685dc5e45d4d94a Mon Sep 17 00:00:00 2001 From: Harprit Chhabada Date: Thu, 27 Sep 2018 15:46:50 -0700 Subject: [PATCH] qcacmn: Add bound check for desc_id Add bound check for desc_id in tgt_mgmt_txrx_tx_completion_handler() to check OOB issue. Change-Id: Ib28852a1c1ccf06af14004bf4001ce0938391f3d CRs-Fixed: 2318632 --- .../mgmt_txrx/dispatcher/src/wlan_mgmt_txrx_tgt_api.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/umac/cmn_services/mgmt_txrx/dispatcher/src/wlan_mgmt_txrx_tgt_api.c b/umac/cmn_services/mgmt_txrx/dispatcher/src/wlan_mgmt_txrx_tgt_api.c index 464eb790985f..85058d78c3ad 100644 --- a/umac/cmn_services/mgmt_txrx/dispatcher/src/wlan_mgmt_txrx_tgt_api.c +++ b/umac/cmn_services/mgmt_txrx/dispatcher/src/wlan_mgmt_txrx_tgt_api.c @@ -1025,6 +1025,10 @@ QDF_STATUS tgt_mgmt_txrx_tx_completion_handler( mgmt_txrx_err("Mgmt txrx context empty for pdev %pK", pdev); return QDF_STATUS_E_NULL_VALUE; } + if (desc_id >= MGMT_DESC_POOL_MAX) { + mgmt_txrx_err("desc_id:%u is out of bounds", desc_id); + return QDF_STATUS_E_INVAL; + } mgmt_desc = &mgmt_txrx_pdev_ctx->mgmt_desc_pool.pool[desc_id]; if (!mgmt_desc) { mgmt_txrx_err("Mgmt desc empty for id %d pdev %pK ",