1
0

qcacld-3.0: Out of bound access in ML connection

Currently, while fetching pcl for some vdev id, host driver retrieves
the number of ML connection and provide as max index value for vdev list
and info array. This max index  can't be more than
MAX_NUMBER_OF_CONC_CONNECTIONS from functionality perspective.
But static analyzer tool complains that there are chances for out of
bound access of the given arrays while filling the indexes.
So, to fix this, add checks to avoid any such possible out bound access.

Change-Id: I09261e23620df5fc73887c9e5633b408afa66796
CRs-Fixed: 3412348
Este cometimento está contido em:
Rahul Gusain
2023-02-20 18:38:51 +05:30
cometido por Madan Koyyalamudi
ascendente d98325bcea
cometimento 3064b4603c

Ver ficheiro

@@ -238,7 +238,9 @@ policy_mgr_get_pcl_concurrent_connetions(struct wlan_objmgr_psoc *psoc,
if (!has_same_band && vdev_id_with_diff_band != WLAN_INVALID_VDEV_ID) {
policy_mgr_debug("vdev_ids[%d]: %d",
num_related, vdev_id_with_diff_band);
vdev_ids[num_related++] = vdev_id_with_diff_band;
if (num_related < vdev_ids_size)
vdev_ids[num_related++] = vdev_id_with_diff_band;
}
out:
@@ -289,7 +291,7 @@ QDF_STATUS policy_mgr_get_pcl_for_vdev_id(struct wlan_objmgr_psoc *psoc,
id_num = policy_mgr_get_pcl_concurrent_connetions(psoc, mode,
vdev_id, ids,
QDF_ARRAY_SIZE(ids));
if (!id_num) {
if (!id_num || id_num > MAX_NUMBER_OF_CONC_CONNECTIONS) {
status = QDF_STATUS_E_FAILURE;
goto out;
}