Kaynağa Gözat

qcacmn: Add a sanity check for 6G ap type and client type

Add a sanity check for ap type and client type in the APIs
reg_get_cur_6g_ap_pwr_type and reg_get_cur_6g_client_type respectively,
to prevent array index out of bounds.

Change-Id: I4c9ee7e742089e6b494b731d223b76b069fe1200
CRs-Fixed: 2919361
Hariharan Basuthkar 4 yıl önce
ebeveyn
işleme
28de31d838
1 değiştirilmiş dosya ile 11 ekleme ve 3 silme
  1. 11 3
      umac/regulatory/core/src/reg_services_common.c

+ 11 - 3
umac/regulatory/core/src/reg_services_common.c

@@ -4217,7 +4217,12 @@ reg_get_cur_6g_ap_pwr_type(struct wlan_objmgr_pdev *pdev,
 		reg_err("pdev reg component is NULL");
 		return QDF_STATUS_E_FAILURE;
 	}
+
+	if (pdev_priv_obj->reg_cur_6g_ap_pwr_type >= REG_CURRENT_MAX_AP_TYPE)
+		return QDF_STATUS_E_FAILURE;
+
 	*reg_cur_6g_ap_pwr_type = pdev_priv_obj->reg_cur_6g_ap_pwr_type;
+
 	return QDF_STATUS_SUCCESS;
 }
 
@@ -4233,8 +4238,14 @@ reg_get_cur_6g_client_type(struct wlan_objmgr_pdev *pdev,
 		reg_err("pdev reg component is NULL");
 		return QDF_STATUS_E_FAILURE;
 	}
+
+	if (pdev_priv_obj->reg_cur_6g_client_mobility_type >=
+	    REG_MAX_CLIENT_TYPE)
+		return QDF_STATUS_E_FAILURE;
+
 	*reg_cur_6g_client_mobility_type =
 	    pdev_priv_obj->reg_cur_6g_client_mobility_type;
+
 	return QDF_STATUS_SUCCESS;
 }
 
@@ -4419,9 +4430,6 @@ QDF_STATUS reg_get_client_power_for_6ghz_ap(struct wlan_objmgr_pdev *pdev,
 		return QDF_STATUS_E_FAILURE;
 	}
 
-	if (ap_pwr_type >= REG_CURRENT_MAX_AP_TYPE)
-		return QDF_STATUS_E_FAILURE;
-
 	master_chan_list = pdev_priv_obj->
 			mas_chan_list_6g_client[ap_pwr_type][client_type];