From 391566971c7163181300ad502b5c71c5779afd0c Mon Sep 17 00:00:00 2001 From: hqu Date: Wed, 22 May 2019 15:21:26 +0800 Subject: qcacld-2.0: Add bound check for fixed_param->total_num_tx_power_levels propagation from qcacld-3.0 to qcacld-2.0 Add bound check for new fixed_param->total_num_tx_power_levels with its old value of rs_results->total_num_tx_power_levels in wma_unified_radio_tx_power_level_stats_event_handler. rs_results->tx_time_per_power_level is allocated only once if it has not been already allocated.This allocation is saved into the global wma_handle structure. If multiple invocations of this handler occur then a buffer overflow can occur in the following scenario: 1. First message is used to allocate rs_results->tx_time_per_power_level with a small, but valid size. 2. Second message skips allocation of rs_results->tx_time_per_power_level since it was done with the first message. This message specifies a larger valid value and causes the vos_mem_copy() to overflow. Change-Id: Ia46d5f965584da380509ec2e39a405219e8d216f CRs-Fixed: 2457412 --- CORE/SERVICES/WMA/wma.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/CORE/SERVICES/WMA/wma.c b/CORE/SERVICES/WMA/wma.c index 0b7b88a20f3b..5477ac7e3c70 100644 --- a/CORE/SERVICES/WMA/wma.c +++ b/CORE/SERVICES/WMA/wma.c @@ -5321,6 +5321,15 @@ static int wma_unified_radio_tx_power_level_stats_event_handler(void *handle, rs_results = (tSirWifiRadioStat *) &link_stats_results->results[0]; tx_power_level_values = (uint8 *) param_tlvs->tx_time_per_power_level; + if (rs_results->total_num_tx_power_levels && + fixed_param->total_num_tx_power_levels > + rs_results->total_num_tx_power_levels) { + WMA_LOGE("%s: excess tx_power buffers:%d, total_num_tx_power_levels:%d", + __func__, fixed_param->total_num_tx_power_levels, + rs_results->total_num_tx_power_levels); + return -EINVAL; + } + rs_results->total_num_tx_power_levels = fixed_param->total_num_tx_power_levels; if (!rs_results->total_num_tx_power_levels) -- cgit v1.2.3