diff options
| author | Pragaspathi Thilagaraj <tpragasp@codeaurora.org> | 2020-07-02 20:47:48 +0530 |
|---|---|---|
| committer | Pragaspathi Thilagaraj <tpragasp@codeaurora.org> | 2020-08-03 19:24:09 +0530 |
| commit | 6b752bcccfb9be7000ab1d7e22db492d2f159cfe (patch) | |
| tree | 23abac4d218ff1634d604e6adbbf7d17463f435f /kernel/fork.c | |
| parent | 9e2c5e35519bcc866db387fa61a0519077d82cff (diff) | |
qcacmn: Fix possible OOB access while sending ext stats request
In 32-bit systems, currently there is possible oob access in
send_stats_ext_req_cmd_tlv() is preq->request_data_len is
uin32_t max and len is also of type uint32_t.
Fix possible OOB access while sending ext stats request message
to firmware by validating the requested data length against the
difference between wmi max message size(WMI_SVC_MSG_MAX_SIZE),
size of the wmi command fixed param and wmi tlv header size
WMI_TLV_HDR_SIZE.
Change-Id: I769c9a6b7c0e0f76e2ec1070cac6c69768816454
CRs-Fixed: 2724256
Diffstat (limited to 'kernel/fork.c')
0 files changed, 0 insertions, 0 deletions