Просмотр исходного кода

qcacmn: Add sanity check to avoid len overflow issue in WMI event data

In WMI/WMA, data from event buffer from FW is used without
sanity checks for upper limit in multiple places. This might
lead to a potential integer overflow further leading to buffer
corruption

Add upper bound checks for max limit of event buffer (1536)
in all affected places to prevent the potential integer
overflow

Change-Id: Ic9194a27c4a4c63fc68ff7fc61165a53e66ca4f4
CRs-Fixed: 2095545
Varun Reddy Yeturu 7 лет назад
Родитель
Сommit
1aa91d9c60
1 измененных файлов с 1 добавлено и 0 удалено
  1. 1 0
      wmi_unified_param.h

+ 1 - 0
wmi_unified_param.h

@@ -93,6 +93,7 @@
 #define WMI_MSEC_TO_USEC(msec)       (msec * 1000) /* msec to usec */
 #define WMI_NLO_FREQ_THRESH          1000       /* in MHz */
 
+#define WMI_SVC_MSG_MAX_SIZE   1536
 #define MAX_UTF_EVENT_LENGTH	2048
 #define MAX_WMI_UTF_LEN	252
 #define MAX_WMI_QVIT_LEN	252