qcacmn: Check number of NOA descriptors

There is possible to read buffer overflow. Since it don't check number
of NOA descriptor when handling WMI_P2P_NOA_EVENTID.

Change-Id: I08fc3ac429bc19a8df7ac429fbe779fa3b227318
CRs-Fixed: 2307321
This commit is contained in:
Wu Gao
2018-09-04 16:16:37 +08:00
committed by nshrivas
orang tua ed139ff584
melakukan 3777304934

Melihat File

@@ -18527,6 +18527,11 @@ static QDF_STATUS extract_p2p_noa_ev_param_tlv(
(uint8_t) WMI_UNIFIED_NOA_ATTR_CTWIN_GET(wmi_noa_info);
descriptors = WMI_UNIFIED_NOA_ATTR_NUM_DESC_GET(wmi_noa_info);
param->num_desc = (uint8_t) descriptors;
if (param->num_desc > WMI_P2P_MAX_NOA_DESCRIPTORS) {
WMI_LOGE("%s: invalid num desc:%d", __func__,
param->num_desc);
return QDF_STATUS_E_INVAL;
}
WMI_LOGD("%s:index %u, opps_ps %u, ct_window %u, num_descriptors = %u", __func__,
param->index, param->opps_ps, param->ct_window,