diff options
| author | Himanshu Agarwal <himanaga@codeaurora.org> | 2017-12-22 14:00:01 +0530 |
|---|---|---|
| committer | snandini <snandini@codeaurora.org> | 2017-12-28 06:16:19 -0800 |
| commit | 491e2a9d51e71dc64d6ce2af7b07d37c9d52c974 (patch) | |
| tree | df723f2e48d514ee719f5ab7fd270e0ed58999cc | |
| parent | 2dbd873d0bf95b7c1f77496991a80ab5b204a8a4 (diff) | |
qcacld-3.0: Add num_debug_register check to avoid OOB access
Add num_debug_register check in
wma_unified_power_debug_stats_event_handler() to avoid OOB access.
Change-Id: Iae206bc467a940a8fbc1128bff498af958df1c04
CRs-Fixed: 2160403
| -rw-r--r-- | core/wma/src/wma_features.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/core/wma/src/wma_features.c b/core/wma/src/wma_features.c index 79784edde7a1..ebf8b0cfbeb2 100644 --- a/core/wma/src/wma_features.c +++ b/core/wma/src/wma_features.c @@ -10581,7 +10581,8 @@ int wma_unified_power_debug_stats_event_handler(void *handle, if (param_buf->num_debug_register > ((WMI_SVC_MSG_MAX_SIZE - sizeof(wmi_pdev_chip_power_stats_event_fixed_param)) / - sizeof(uint32_t))) { + sizeof(uint32_t)) || + param_buf->num_debug_register > param_tlvs->num_debug_registers) { WMA_LOGE("excess payload: LEN num_debug_register:%u", param_buf->num_debug_register); return -EINVAL; |