diff options
| author | Krunal Soni <ksoni@codeaurora.org> | 2017-10-03 19:39:48 -0700 |
|---|---|---|
| committer | snandini <snandini@codeaurora.org> | 2017-10-06 14:15:53 -0700 |
| commit | af5433a097fc715cf7689f60edc60b996482d117 (patch) | |
| tree | 3b4eba1865fd15c8b651e42a5fab7dd2738ba86b | |
| parent | b80c613564832c27c46a937efe2b9ed3c695777b (diff) | |
qcacld-3.0: Do boundary check on num_vdev_mac_entries param
Current doesn't perform boundary check on num_vdev_mac_entries param
which coming from firmware. Without boundary check, driver may be
exposed to buffer overflow.
Check against the boundary limit before using it.
CRs-Fixed: 2119430
Change-Id: I502926a7f783acc7b73a3fbbbd70386a099b48b3
| -rw-r--r-- | core/wma/src/wma_main.c | 5 |
1 files changed, 5 insertions, 0 deletions
diff --git a/core/wma/src/wma_main.c b/core/wma/src/wma_main.c index 0394afb01f48..08c54d4fa6c6 100644 --- a/core/wma/src/wma_main.c +++ b/core/wma/src/wma_main.c @@ -3087,6 +3087,11 @@ static int wma_pdev_set_hw_mode_resp_evt_handler(void *handle, */ goto fail; } + if (param_buf->fixed_param->num_vdev_mac_entries >= + MAX_VDEV_SUPPORTED) { + WMA_LOGE("num_vdev_mac_entries crossed max value"); + goto fail; + } wmi_event = param_buf->fixed_param; hw_mode_resp->status = wmi_event->status; |