diff options
| author | Arif Hussain <arifhussain@codeaurora.org> | 2018-12-21 14:58:55 -0800 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2019-04-01 20:27:18 -0700 |
| commit | 3963fd07c29d618d35ddd2decd2db009256be110 (patch) | |
| tree | 26c572dd65b7ca3f7b56c458a2e70679f1f1c59c | |
| parent | 00ad42a92dcaec314779da9973bb58e932809cca (diff) | |
qcacmn: Validate number of entries in extract_host_mem_req_tlv()
Validate num_mem_reqs should be less than TLV size in
extract_host_mem_req_tlv() function.
Change-Id: I88ebfc4bfe3abb9b0926990f5f777fc0d62e1fc1
CRs-Fixed: 2347667
| -rw-r--r-- | wmi/src/wmi_unified_tlv.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/wmi/src/wmi_unified_tlv.c b/wmi/src/wmi_unified_tlv.c index 346879f9865b..95286ee66ad4 100644 --- a/wmi/src/wmi_unified_tlv.c +++ b/wmi/src/wmi_unified_tlv.c @@ -13027,6 +13027,12 @@ static host_mem_req *extract_host_mem_req_tlv(wmi_unified_t wmi_handle, return NULL; } + if (ev->num_mem_reqs > param_buf->num_mem_reqs) { + WMI_LOGE("Invalid num_mem_reqs %d:%d", + ev->num_mem_reqs, param_buf->num_mem_reqs); + return NULL; + } + *num_entries = ev->num_mem_reqs; return (host_mem_req *)param_buf->mem_reqs; |