diff options
| author | Abhishek Ambure <aambure@codeaurora.org> | 2019-12-26 15:21:15 +0530 |
|---|---|---|
| committer | Abhishek Ambure <aambure@codeaurora.org> | 2019-12-26 16:04:31 +0530 |
| commit | 4eb1c1dc9d80c19f2d0ce4a60a8e7b68bb8be7b9 (patch) | |
| tree | 54cfb67f631c01326eb12021fff2c401b0db32e3 /lib/dma-debug.c | |
| parent | 36c680dbc553eed12d5e4fcb54a414ff62ec09bc (diff) | |
qcacld-3.0: Add max index check for dscp_to_up_map array
In SME layer, boundary check for dscp_to_up_map array is not present.
The dscpmapping is an array of 0x40 elements. Values in dscp_exceptions
are used to index dscpmapping. The indices are not validated to be less
than 0x40. The dscp_exceptions array is received from association
response frame. A malicious AP can send values up to 0xff, causing OOB
write of dscpmapping array.
Hence, max index check is added to avoid OOB write of dscpmapping array.
Change-Id: I73526849677e867673fc0bd0024ed2b003e4f89e
CRs-Fixed: 2569764
Diffstat (limited to 'lib/dma-debug.c')
0 files changed, 0 insertions, 0 deletions