samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacld-3.0: Add checks for security vulnerability

Browse Source 
Add checks to extscan and ocb FW message handlers.

Change-Id: I1ff5b1f8722545de4cc4f10d23ff9b914ae3428c
CRs-Fixed: 2119054
This commit is contained in:
Amar Singhal
2017-10-03 13:32:21 -07:00
committed by snandini
parent 4aaa6c4946
commit 16c170d21c
2 changed files with 16 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
core/wma/src/wma_ocb.c
View File

@@ -673,6 +673,14 @@ static int wma_dcc_stats_event_handler(void *handle, uint8_t *event_buf,
response->num_channels = fix_param->num_channels;
response->channel_stats_array_len =
fix_param->num_channels * sizeof(wmi_dcc_ndl_stats_per_channel);
if (fix_param->num_channels > param_tlvs->num_stats_per_channel_list) {
WMA_LOGE("FW message num_chan %d more than TLV hdr %d",
fix_param->num_channels,
param_tlvs->num_stats_per_channel_list);
return -EINVAL;
}
response->channel_stats_array = ((void *)response) + sizeof(*response);
qdf_mem_copy(response->channel_stats_array,
param_tlvs->stats_per_channel_list,

8
core/wma/src/wma_scan_roam.c
View File

@@ -3561,6 +3561,14 @@ int wma_extscan_operations_event_handler(void *handle,
case WMI_EXTSCAN_CYCLE_STARTED_EVENT:
WMA_LOGD("%s: received WMI_EXTSCAN_CYCLE_STARTED_EVENT",
__func__);
if (oprn_event->num_buckets > param_buf->num_bucket_id) {
WMA_LOGE("FW mesg num_buk %d more than TLV hdr %d",
oprn_event->num_buckets,
param_buf->num_bucket_id);
return -EINVAL;
}
cds_host_diag_log_work(&wma->extscan_wake_lock,
WMA_EXTSCAN_CYCLE_WAKE_LOCK_DURATION,
WIFI_POWER_EVENT_WAKELOCK_EXT_SCAN);