diff options
| author | Amar Singhal <asinghal@codeaurora.org> | 2017-10-06 14:56:42 -0700 |
|---|---|---|
| committer | snandini <snandini@codeaurora.org> | 2017-10-11 19:17:19 -0700 |
| commit | 91027696056a100eb4b6d9095fc478bf1a7222fc (patch) | |
| tree | f7c9e973de615d3761c4c06f876337aa8cf24761 /core/utils | |
| parent | f03212985e9c6a0cdb06eab6312e4eb08cb6cc87 (diff) | |
qcacld-3.0: Check for buffer overflow for diag messages
Check for buffer overflow from diag messages.
Change-Id: I9618a7b581739602efeacefe1844fd4243b55d53
CRs-Fixed: 2119449
Diffstat (limited to 'core/utils')
| -rw-r--r-- | core/utils/fwlog/dbglog_host.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/core/utils/fwlog/dbglog_host.c b/core/utils/fwlog/dbglog_host.c index 59dd6ff7d931..df724889af4a 100644 --- a/core/utils/fwlog/dbglog_host.c +++ b/core/utils/fwlog/dbglog_host.c @@ -1683,18 +1683,22 @@ static int send_fw_diag_nl_data(const uint8_t *buffer, A_UINT32 len, static int process_fw_diag_event_data(uint8_t *datap, uint32_t num_data) { - uint32_t i; uint32_t diag_type; uint32_t nl_data_len; /* diag hdr + payload */ uint32_t diag_data_len; /* each fw diag payload */ struct wlan_diag_data *diag_data; - for (i = 0; i < num_data; i++) { + while (num_data > 0) { diag_data = (struct wlan_diag_data *)datap; diag_type = WLAN_DIAG_0_TYPE_GET(diag_data->word0); diag_data_len = WLAN_DIAG_0_LEN_GET(diag_data->word0); /* Length of diag struct and len of payload */ nl_data_len = sizeof(struct wlan_diag_data) + diag_data_len; + if (nl_data_len > num_data) { + AR_DEBUG_PRINTF(ATH_DEBUG_INFO, + ("processed all the messages\n")); + return 0; + } switch (diag_type) { case DIAG_TYPE_FW_EVENT: @@ -1708,6 +1712,7 @@ process_fw_diag_event_data(uint8_t *datap, uint32_t num_data) } /* Move to the next event and send to cnss-diag */ datap += nl_data_len; + num_data -= nl_data_len; } return 0; |