samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacmn: Fix buffer overflow in process_tx_info and process_rx_info

Browse Source 
Currently data in "pl_tgt_hdr" is used directly from firmware without
any length check which may cause buffer over-read.

To address this issue add length check before accessing data offset

Change-Id: Ic2930fdf7168b79a8522be282b0e1cd19214742a
CRs-Fixed: 2191170
This commit is contained in:
jitiphil
2018-02-16 19:18:25 +05:30
committed by nshrivas
parent 974da2640a
commit 0081d767f1
3 changed files with 505 additions and 66 deletions
Download Patch File Download Diff File Expand all files Collapse all files

6
utils/pktlog/include/pktlog_ac.h
View File

@@ -1,5 +1,5 @@
/*
* Copyright (c) 2012-2017 The Linux Foundation. All rights reserved.
* Copyright (c) 2012-2018 The Linux Foundation. All rights reserved.
*
* Previously licensed under the ISC license by Qualcomm Atheros, Inc.
*
@@ -146,7 +146,7 @@ int pktlog_disable(struct hif_opaque_softc *scn);
int pktlogmod_init(void *context);
void pktlogmod_exit(void *context);
int pktlog_htc_attach(void);
void pktlog_process_fw_msg(uint32_t *msg_word);
void pktlog_process_fw_msg(uint32_t *msg_word, uint32_t msg_len);
void lit_pktlog_callback(void *context, enum WDI_EVENT event, void *log_data,
u_int16_t peer_id, uint32_t status);
@@ -192,7 +192,7 @@ static inline int pktlog_htc_attach(void)
{
return 0;
}
static inline void pktlog_process_fw_msg(uint32_t *msg_word)
static inline void pktlog_process_fw_msg(uint32_t *msg_word, uint32_t msg_len)
{ }
#endif /* REMOVE_PKT_LOG */
#endif /* _PKTLOG_AC_H_ */