diff options
| author | CNSS_WLAN Service <cnssbldsw@qualcomm.com> | 2017-09-20 21:52:15 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-09-20 21:52:15 -0700 |
| commit | 3f46b97e37783088a151c4169576fd8aa67d0020 (patch) | |
| tree | 2fe449b7466f11d70c2558e0cded2aa785b07f6d | |
| parent | 7f199396222a8102ed43cee0e425d25a5ddb45bf (diff) | |
| parent | beef27b6c204119e10bd6b484d73627ae5046b57 (diff) | |
Merge "qcacmn: Validate buffer length in wmi tlv check and pad tlvs" into wlan-cmn.driver.lnx.1.0
| -rw-r--r-- | wmi/src/wmi_tlv_helper.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/wmi/src/wmi_tlv_helper.c b/wmi/src/wmi_tlv_helper.c index 124615201063..b6931f51a0fa 100644 --- a/wmi/src/wmi_tlv_helper.c +++ b/wmi/src/wmi_tlv_helper.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2013-2016 The Linux Foundation. All rights reserved. + * Copyright (c) 2013-2017 The Linux Foundation. All rights reserved. * * Previously licensed under the ISC license by Qualcomm Atheros, Inc. * @@ -518,6 +518,13 @@ wmitlv_check_and_pad_tlvs(void *os_handle, void *param_struc_ptr, } /* NOTE: the returned number of TLVs is in "attr_struct_ptr.cmd_num_tlv" */ + if (param_buf_len < WMI_TLV_HDR_SIZE) { + wmi_tlv_print_error + ("%s: ERROR: Incorrect param buf length passed\n", + __func__); + return error; + } + /* Create base structure of format wmi_cmd_event_id##_param_tlvs */ len_wmi_cmd_struct_buf = attr_struct_ptr.cmd_num_tlv * sizeof(wmitlv_cmd_param_info); |