Explorar el Código

qcacmn: Fix the integer overflow issue

In the assignment of varaible expected_field_info_size with an expression,
there might be an issue of integer overflow.

To fix this issue add a check for the expression with UINT_MAX
before assigning the expression to variable expected_field_info_size.

Change-Id: Iaa58fc164655d5b074eef55f8fd78f83a71e3fdf
CRs-Fixed: 2825846
Abdul Muqtadeer Ahmed hace 4 años
padre
commit
3921edb0ae
Se han modificado 1 ficheros con 7 adiciones y 1 borrados
  1. 7 1
      os_if/linux/wifi_pos/src/os_if_wifi_pos.c

+ 7 - 1
os_if/linux/wifi_pos/src/os_if_wifi_pos.c

@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2020 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2021 The Linux Foundation. All rights reserved.
  *
  * Permission to use, copy, modify, and/or distribute this software for
  * any purpose with or without fee is hereby granted, provided that the
@@ -728,6 +728,12 @@ static int  wifi_pos_parse_ani_req(const void *data, int len, int pid,
 		return 0;
 	}
 
+	if ((field_info->count - 1) >
+	    ((UINT_MAX - sizeof(*field_info)) /
+	    sizeof(struct wifi_pos_field))) {
+		return OEM_ERR_INVALID_MESSAGE_LENGTH;
+	}
+
 	expected_field_info_size = sizeof(*field_info) +
 		(field_info->count - 1) * sizeof(struct wifi_pos_field);