diff options
| author | Abhinav Kumar <abhikuma@codeaurora.org> | 2017-10-16 17:19:05 +0530 |
|---|---|---|
| committer | snandini <snandini@codeaurora.org> | 2017-10-29 11:56:50 -0700 |
| commit | 6e54c080cf2f5010eafffa113c0fd2cf4996de6d (patch) | |
| tree | b80fb0562b2da33c4c290d5a516225f98442949d | |
| parent | fe0e2a333308884e1e76ef2682e823995a0d403d (diff) | |
qcacld-2.0: Do check for datalen in wma_process_uft_event
Check for data length against the size of the structure.
Change-Id: Ia8107053ca9c109632ea02a0c8fa677f19e4e225
CRs-Fixed: 2125776
| -rw-r--r-- | CORE/SERVICES/WMA/wma.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/CORE/SERVICES/WMA/wma.c b/CORE/SERVICES/WMA/wma.c index 57f3859054d8..b25c7c204e0b 100644 --- a/CORE/SERVICES/WMA/wma.c +++ b/CORE/SERVICES/WMA/wma.c @@ -38202,6 +38202,11 @@ wma_process_utf_event(WMA_HANDLE handle, data = param_buf->data; datalen = param_buf->num_data; + if (datalen < sizeof(segHdrInfo)) { + WMA_LOGE("message size %d is smaller than struct seg_hdr_info", + datalen); + return -EINVAL; + } segHdrInfo = *(SEG_HDR_INFO_STRUCT *)&(data[0]); |