diff options
| author | Ke Huang <keh@codeaurora.org> | 2017-10-16 10:58:03 +0800 |
|---|---|---|
| committer | snandini <snandini@codeaurora.org> | 2017-11-27 22:12:43 -0800 |
| commit | 3326ecc4944df6bb9351a736b43008d64724d4e9 (patch) | |
| tree | f0f92d939cf6ed8234bf54b96619d3b32471a220 | |
| parent | de7d14350f8a39d54b8f752ee600566d6bfab1c2 (diff) | |
qcacld-2.0: Add sanity check for vdev id to prevent OOB access
Add sanity check for vdev id in wma_roam_event_callback() to prevent
out of bound access of memory in wma_roam_better_ap_handler().
Change-Id: Ifbcf5023afe8fac3bf1ad59d351a3777d699b0cb
CRs-Fixed: 2127900
| -rw-r--r-- | CORE/SERVICES/WMA/wma.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/CORE/SERVICES/WMA/wma.c b/CORE/SERVICES/WMA/wma.c index 5f41547000e7..f6a469667961 100644 --- a/CORE/SERVICES/WMA/wma.c +++ b/CORE/SERVICES/WMA/wma.c @@ -34744,6 +34744,11 @@ static int wma_roam_event_callback(WMA_HANDLE handle, u_int8_t *event_buf, WMA_LOGD("%s: Reason %x for vdevid %x, rssi %d", __func__, wmi_event->reason, wmi_event->vdev_id, wmi_event->rssi); + if (wmi_event->vdev_id >= wma_handle->max_bssid) { + WMA_LOGE("Invalid vdev id from firmware"); + return -EINVAL; + } + DPTRACE(adf_dp_trace_record_event(ADF_DP_TRACE_EVENT_RECORD, wmi_event->vdev_id, ADF_PROTO_TYPE_EVENT, ADF_ROAM_EVENTID)); |