diff options
| author | Amar Singhal <asinghal@codeaurora.org> | 2017-10-03 13:32:21 -0700 |
|---|---|---|
| committer | snandini <snandini@codeaurora.org> | 2017-10-11 13:10:07 -0700 |
| commit | 2dfd0a5505ddb43a46bacfd77d62dba014b2c9f8 (patch) | |
| tree | fd9f6cd0a7519bb7f739699637b1fd5ab4a584c5 | |
| parent | d054c8c828d8d0cdc8624f499ca1b461664c5afb (diff) | |
qcacld-3.0: Add checks for security vulnerability
Add checks to extscan and ocb FW message handlers.
Change-Id: I1ff5b1f8722545de4cc4f10d23ff9b914ae3428c
CRs-Fixed: 2119054
| -rw-r--r-- | core/wma/src/wma_ocb.c | 8 | ||||
| -rw-r--r-- | core/wma/src/wma_scan_roam.c | 8 |
2 files changed, 16 insertions, 0 deletions
diff --git a/core/wma/src/wma_ocb.c b/core/wma/src/wma_ocb.c index 16e9e3ef167a..745a7868052c 100644 --- a/core/wma/src/wma_ocb.c +++ b/core/wma/src/wma_ocb.c @@ -675,6 +675,14 @@ static int wma_dcc_stats_event_handler(void *handle, uint8_t *event_buf, response->num_channels = fix_param->num_channels; response->channel_stats_array_len = fix_param->num_channels * sizeof(wmi_dcc_ndl_stats_per_channel); + + if (fix_param->num_channels > param_tlvs->num_stats_per_channel_list) { + WMA_LOGE("FW message num_chan %d more than TLV hdr %d", + fix_param->num_channels, + param_tlvs->num_stats_per_channel_list); + return -EINVAL; + } + response->channel_stats_array = ((void *)response) + sizeof(*response); qdf_mem_copy(response->channel_stats_array, param_tlvs->stats_per_channel_list, diff --git a/core/wma/src/wma_scan_roam.c b/core/wma/src/wma_scan_roam.c index 6aac284c497b..d9ed6e2678bb 100644 --- a/core/wma/src/wma_scan_roam.c +++ b/core/wma/src/wma_scan_roam.c @@ -4218,6 +4218,14 @@ int wma_extscan_operations_event_handler(void *handle, case WMI_EXTSCAN_CYCLE_STARTED_EVENT: WMA_LOGD("%s: received WMI_EXTSCAN_CYCLE_STARTED_EVENT", __func__); + + if (oprn_event->num_buckets > param_buf->num_bucket_id) { + WMA_LOGE("FW mesg num_buk %d more than TLV hdr %d", + oprn_event->num_buckets, + param_buf->num_bucket_id); + return -EINVAL; + } + cds_host_diag_log_work(&wma->extscan_wake_lock, WMA_EXTSCAN_CYCLE_WAKE_LOCK_DURATION, WIFI_POWER_EVENT_WAKELOCK_EXT_SCAN); |