samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacmn: Validate the buffer length in fips event handler

Browse Source 
In the WMI_PDEV_FIPS_EVENTID event handling, add a length
check to validate if the buffer length sent by the firmware
in fixed params is less than or equal to the actual buffer
length before processing the data.

Change-Id: I7a952d3e3a2f66060451263b72118a52aa89dd06
CRs-Fixed: 3009887
This commit is contained in:
Surya Prakash Sivaraj
2021-08-12 14:05:25 +05:30
committed by Madan Koyyalamudi
parent 07fc0519ee
commit 39f2f9dcfa
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
wmi/src/wmi_unified_tlv.c
View File

@@ -12138,6 +12138,9 @@ static QDF_STATUS extract_fips_event_data_tlv(wmi_unified_t wmi_handle,
param_buf = (WMI_PDEV_FIPS_EVENTID_param_tlvs *) evt_buf;
event = (wmi_pdev_fips_event_fixed_param *) param_buf->fixed_param;
if (event->data_len > param_buf->num_data)
return QDF_STATUS_E_FAILURE;
if (fips_conv_data_be(event->data_len, param_buf->data) !=
QDF_STATUS_SUCCESS)
return QDF_STATUS_E_FAILURE;