diff options
| author | Himanshu Agarwal <himanaga@codeaurora.org> | 2017-10-04 14:15:04 +0530 |
|---|---|---|
| committer | snandini <snandini@codeaurora.org> | 2017-10-06 14:15:47 -0700 |
| commit | 5bb80a6b110477965a69f1ec737246d6fe80d3b0 (patch) | |
| tree | d765b8180fb794ba5753f4e0ae41df6c2c6001ab | |
| parent | e73bcb155bb84853db26530ba36a8bd0488adb3a (diff) | |
qcacld-3.0: Add sanity check for vdev id to prevent OOB access
Add sanity check for vdev id in wma_roam_event_callback() to prevent
out of bound access of memory in wma_roam_better_ap_handler().
Change-Id: If3cf06a8eca767201fdd8b056bee6d773938a2a6
CRs-Fixed: 2119400
| -rw-r--r-- | core/wma/src/wma_scan_roam.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/core/wma/src/wma_scan_roam.c b/core/wma/src/wma_scan_roam.c index 24c328bfaabf..989bb4ded10b 100644 --- a/core/wma/src/wma_scan_roam.c +++ b/core/wma/src/wma_scan_roam.c @@ -6264,6 +6264,10 @@ int wma_roam_event_callback(WMA_HANDLE handle, uint8_t *event_buf, (wmi_event->reason == WMI_ROAM_REASON_INVALID) ? wmi_event->notif : wmi_event->rssi); + if (wmi_event->vdev_id >= wma_handle->max_bssid) { + WMA_LOGE("Invalid vdev id from firmware"); + return -EINVAL; + } DPTRACE(qdf_dp_trace_record_event(QDF_DP_TRACE_EVENT_RECORD, wmi_event->vdev_id, QDF_PROTO_TYPE_EVENT, QDF_ROAM_EVENTID)); |