Browse Source

qcacmn: Validate num_links before accessing data

In util_parse_rv_info_from_linkinfo, accessing the array of data
without validating the index of the array will cause OOB issue.

Add check with the maximum size of the array before accessing the
data.

Change-Id: Ie8b33c83fa1cd18cfbfcb6c7a82b79ddd86e8808
CRs-Fixed: 3580821
Vinod Kumar Myadam 1 year ago
parent
commit
151331ba76
1 changed files with 6 additions and 0 deletions
  1. 6 0
      umac/mlo_mgr/src/utils_mlo.c

+ 6 - 0
umac/mlo_mgr/src/utils_mlo.c

@@ -4523,6 +4523,12 @@ util_parse_rv_info_from_linkinfo(uint8_t *linkinfo,
 								      &ap_removal_timer);
 			if (QDF_IS_STATUS_ERROR(ret))
 				return ret;
+			if (reconfig_info->num_links >=
+						WLAN_UMAC_MLO_MAX_VDEVS) {
+				mlo_err("num_link %d invalid",
+					reconfig_info->num_links);
+				return QDF_STATUS_E_INVAL;
+			}
 			link_info =
 			&reconfig_info->link_info[reconfig_info->num_links];
 			link_info->link_id = linkid;