qcacmn: Check number of NOA descriptors
There is possible to read buffer overflow. Since it don't check number of NOA descriptor when handling WMI_P2P_NOA_EVENTID. Change-Id: I08fc3ac429bc19a8df7ac429fbe779fa3b227318 CRs-Fixed: 2307321
This commit is contained in:
@@ -18527,6 +18527,11 @@ static QDF_STATUS extract_p2p_noa_ev_param_tlv(
|
||||
(uint8_t) WMI_UNIFIED_NOA_ATTR_CTWIN_GET(wmi_noa_info);
|
||||
descriptors = WMI_UNIFIED_NOA_ATTR_NUM_DESC_GET(wmi_noa_info);
|
||||
param->num_desc = (uint8_t) descriptors;
|
||||
if (param->num_desc > WMI_P2P_MAX_NOA_DESCRIPTORS) {
|
||||
WMI_LOGE("%s: invalid num desc:%d", __func__,
|
||||
param->num_desc);
|
||||
return QDF_STATUS_E_INVAL;
|
||||
}
|
||||
|
||||
WMI_LOGD("%s:index %u, opps_ps %u, ct_window %u, num_descriptors = %u", __func__,
|
||||
param->index, param->opps_ps, param->ct_window,
|
||||
|
Reference in New Issue
Block a user