From 6eae53d64a568486f3c140656e9623eac9400d20 Mon Sep 17 00:00:00 2001 From: Dustin Brown Date: Wed, 14 Dec 2016 12:12:24 -0800 Subject: qcacld-3.0: Validate packet filter data offset When configuring a packet filter request, ensure the provided data offset values are less than the maximum data offset supported by firmware. Change-Id: I74ac672dd51245ab954457fdc87bd1e8421b3e1b CRs-Fixed: 1101487 --- core/hdd/src/wlan_hdd_wext.c | 9 +++++++++ core/mac/inc/sir_api.h | 1 + 2 files changed, 10 insertions(+) diff --git a/core/hdd/src/wlan_hdd_wext.c b/core/hdd/src/wlan_hdd_wext.c index 99c0f20a591c..9acc881c9693 100644 --- a/core/hdd/src/wlan_hdd_wext.c +++ b/core/hdd/src/wlan_hdd_wext.c @@ -8994,6 +8994,15 @@ static int wlan_hdd_set_filter(hdd_context_t *hdd_ctx, request->params_data[i].data_length; packetFilterSetReq.paramsData[i].reserved = 0; + if (request->params_data[i].data_offset > + SIR_MAX_FILTER_TEST_DATA_OFFSET) { + hdd_err("Invalid data offset %u for param %d (max = %d)", + request->params_data[i].data_offset, + i, + SIR_MAX_FILTER_TEST_DATA_OFFSET); + return -EINVAL; + } + if (request->params_data[i].data_length > SIR_MAX_FILTER_TEST_DATA_LEN) { hdd_err("Error invalid data length %d", diff --git a/core/mac/inc/sir_api.h b/core/mac/inc/sir_api.h index cf53ee6aaa53..d43321bf0643 100644 --- a/core/mac/inc/sir_api.h +++ b/core/mac/inc/sir_api.h @@ -3131,6 +3131,7 @@ typedef struct sSirRoamOffloadScanRsp { Packet Filtering Parameters ---------------------------------------------------------------------------*/ #define SIR_MAX_FILTER_TEST_DATA_LEN 8 +#define SIR_MAX_FILTER_TEST_DATA_OFFSET 200 #define SIR_MAX_NUM_MULTICAST_ADDRESS 240 #define SIR_MAX_NUM_FILTERS 20 #define SIR_MAX_NUM_TESTS_PER_FILTER 10 -- cgit v1.2.3