diff options
| author | hqu <hqu@codeaurora.org> | 2018-11-22 16:20:33 +0800 |
|---|---|---|
| committer | hqu <hqu@codeaurora.org> | 2018-11-22 16:20:33 +0800 |
| commit | e890293dd563ab28c9226def7646ee7c0be948ce (patch) | |
| tree | d442d2e2c3df83d6e939fbd2fe95adc3671e2a76 | |
| parent | 71620598cafbffc15b767cca152c36d4c144198e (diff) | |
qcacld-2.0: Fix possible buffer overflow in wma_stats_ext_req
In the function __wlan_hdd_cfg80211_stats_ext_request, data_len
is recieved from vendor command and is passed ultimately to
wma_stats_ext_req. In wma_stats_ext_req, len is calculated as
sum of sizeof(*cmd), WMI_TLV_HDR_SIZE, preq->request_data_len.
The len is of type u_int16_t and adding
sizeof(*cmd) + WMI_TLV_HDR_SIZE will cause a buffer overflow.
Changed the datatype of len to size_t so that it doesn't overflow.
Change-Id: I6618042e3c60bbdb1ff5d833188f4bdb4832da7a
CRs-Fixed: 2350908
| -rw-r--r-- | CORE/SERVICES/WMA/wma.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/CORE/SERVICES/WMA/wma.c b/CORE/SERVICES/WMA/wma.c index 6caf7425fa98..196988092e63 100644 --- a/CORE/SERVICES/WMA/wma.c +++ b/CORE/SERVICES/WMA/wma.c @@ -30431,7 +30431,7 @@ VOS_STATUS wma_stats_ext_req(void *wda_handle, tp_wma_handle wma = (tp_wma_handle)wda_handle; wmi_req_stats_ext_cmd_fixed_param *cmd; wmi_buf_t buf; - u_int16_t len; + size_t len; u_int8_t *buf_ptr; len = sizeof(*cmd) + WMI_TLV_HDR_SIZE + |