diff options
| author | Dustin Brown <dustinb@codeaurora.org> | 2016-12-14 12:12:24 -0800 |
|---|---|---|
| committer | qcabuildsw <qcabuildsw@localhost> | 2016-12-15 10:21:22 -0800 |
| commit | 6eae53d64a568486f3c140656e9623eac9400d20 (patch) | |
| tree | 6cdada235c7adb966b5a6c905573d1761fdfdb93 | |
| parent | c125ea21ee4728f972cf9ac6017f0336ad2ea7b4 (diff) | |
qcacld-3.0: Validate packet filter data offset
When configuring a packet filter request, ensure the provided data
offset values are less than the maximum data offset supported by
firmware.
Change-Id: I74ac672dd51245ab954457fdc87bd1e8421b3e1b
CRs-Fixed: 1101487
| -rw-r--r-- | core/hdd/src/wlan_hdd_wext.c | 9 | ||||
| -rw-r--r-- | core/mac/inc/sir_api.h | 1 |
2 files changed, 10 insertions, 0 deletions
diff --git a/core/hdd/src/wlan_hdd_wext.c b/core/hdd/src/wlan_hdd_wext.c index 99c0f20a591c..9acc881c9693 100644 --- a/core/hdd/src/wlan_hdd_wext.c +++ b/core/hdd/src/wlan_hdd_wext.c @@ -8994,6 +8994,15 @@ static int wlan_hdd_set_filter(hdd_context_t *hdd_ctx, request->params_data[i].data_length; packetFilterSetReq.paramsData[i].reserved = 0; + if (request->params_data[i].data_offset > + SIR_MAX_FILTER_TEST_DATA_OFFSET) { + hdd_err("Invalid data offset %u for param %d (max = %d)", + request->params_data[i].data_offset, + i, + SIR_MAX_FILTER_TEST_DATA_OFFSET); + return -EINVAL; + } + if (request->params_data[i].data_length > SIR_MAX_FILTER_TEST_DATA_LEN) { hdd_err("Error invalid data length %d", diff --git a/core/mac/inc/sir_api.h b/core/mac/inc/sir_api.h index cf53ee6aaa53..d43321bf0643 100644 --- a/core/mac/inc/sir_api.h +++ b/core/mac/inc/sir_api.h @@ -3131,6 +3131,7 @@ typedef struct sSirRoamOffloadScanRsp { Packet Filtering Parameters ---------------------------------------------------------------------------*/ #define SIR_MAX_FILTER_TEST_DATA_LEN 8 +#define SIR_MAX_FILTER_TEST_DATA_OFFSET 200 #define SIR_MAX_NUM_MULTICAST_ADDRESS 240 #define SIR_MAX_NUM_FILTERS 20 #define SIR_MAX_NUM_TESTS_PER_FILTER 10 |