samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacmn: Check endpoint index range

Browse Source 
Check endpoint range before it be used.
If endpoint is unused return with error.

Change-Id: I2888b0b66c737df677f09040133503e8ace60510
CRs-Fixed: 2138465
This commit is contained in:
Jiachao Wu
2017-11-10 10:13:38 +08:00
committed by snandini
parent 2a4e5d2262
commit 15a94747ef
1 changed files with 14 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
htc/htc_send.c
View File

@@ -1431,7 +1431,13 @@ QDF_STATUS htc_send_pkts_multiple(HTC_HANDLE HTCHandle,
return QDF_STATUS_E_INVAL; return QDF_STATUS_E_INVAL;
} }
AR_DEBUG_ASSERT(pPacket->Endpoint < ENDPOINT_MAX); if ((pPacket->Endpoint >= ENDPOINT_MAX) ||
(pPacket->Endpoint <= ENDPOINT_UNUSED)) {
AR_DEBUG_PRINTF(ATH_DEBUG_SEND,
("%s endpoint is invalid\n", __func__));
AR_DEBUG_ASSERT(0);
return QDF_STATUS_E_INVAL;
}
pEndpoint = &target->endpoint[pPacket->Endpoint]; pEndpoint = &target->endpoint[pPacket->Endpoint];
if (!pEndpoint->service_id) { if (!pEndpoint->service_id) {
@@ -1633,7 +1639,13 @@ QDF_STATUS htc_send_data_pkt(HTC_HANDLE HTCHandle, HTC_PACKET *pPacket,
uint32_t data_attr = 0; uint32_t data_attr = 0;
if (pPacket) { if (pPacket) {
AR_DEBUG_ASSERT(pPacket->Endpoint < ENDPOINT_MAX); if ((pPacket->Endpoint >= ENDPOINT_MAX) ||
(pPacket->Endpoint <= ENDPOINT_UNUSED)) {
AR_DEBUG_PRINTF(ATH_DEBUG_SEND,
("%s endpoint is invalid\n", __func__));
AR_DEBUG_ASSERT(0);
return QDF_STATUS_E_INVAL;
}
pEndpoint = &target->endpoint[pPacket->Endpoint]; pEndpoint = &target->endpoint[pPacket->Endpoint];
/* add HTC_FRAME_HDR in the initial fragment */ /* add HTC_FRAME_HDR in the initial fragment */