浏览代码

qcacld-3.0: Do check for datalen in wma_process_uft_event

Check for data length against the size of the structure.

Change-Id: Ia8107053ca9c109632ea02a0c8fa677f19e4e225
CRs-Fixed: 2118918
Amar Singhal 7 年之前
父节点
当前提交
4aaa6c4946
共有 1 个文件被更改,包括 6 次插入0 次删除
  1. 6 0
      core/wma/src/wma_utils.c

+ 6 - 0
core/wma/src/wma_utils.c

@@ -4141,6 +4141,12 @@ wma_process_utf_event(WMA_HANDLE handle, uint8_t *datap, uint32_t dataplen)
 	data = param_buf->data;
 	datalen = param_buf->num_data;
 
+	if (datalen < sizeof(segHdrInfo)) {
+		WMA_LOGE("message size %d is smaller than struct seg_hdr_info",
+			 datalen);
+		return -EINVAL;
+	}
+
 	segHdrInfo = *(struct seg_hdr_info *) &(data[0]);
 
 	wma_handle->utf_event_info.currentSeq = (segHdrInfo.segmentInfo & 0xF);