Browse Source

qcacld-3.0: Fix potential buffer overflow issues in RRM

Check for the maximum supported neighbor response reports while
parsing the pFrm->NeighborReport.

Change-Id: I4ee93adf79057e803bd948ed8657efcd4327efb8
CRs-Fixed: 2098766
Varun Reddy Yeturu 7 years ago
parent
commit
151376c3bf
1 changed files with 4 additions and 0 deletions
  1. 4 0
      core/mac/src/pe/rrm/rrm_api.c

+ 4 - 0
core/mac/src/pe/rrm/rrm_api.c

@@ -354,6 +354,10 @@ rrm_process_neighbor_report_response(tpAniSirGlobal pMac,
 		pe_err("No neighbor report in the frame...Dropping it");
 		return eSIR_FAILURE;
 	}
+	pe_debug("RRM:received num neighbor reports: %d",
+			pNeighborRep->num_NeighborReport);
+	if (pNeighborRep->num_NeighborReport > MAX_SUPPORTED_NEIGHBOR_RPT)
+		pNeighborRep->num_NeighborReport = MAX_SUPPORTED_NEIGHBOR_RPT;
 	length = (sizeof(tSirNeighborReportInd)) +
 		 (sizeof(tSirNeighborBssDescription) *
 		  (pNeighborRep->num_NeighborReport - 1));