Browse Source

qcacld-3.0: Check for number of entries in fw profiling

Number of profile data from firmware cannot be trusted. Check for
number of entries against the metadata in TLV header.

Change-Id: I0d8078f623a97e33ee1689398c291be75fe9a62a
CRs-Fixed: 2119391
Amar Singhal 7 years ago
parent
commit
4bd222369a
1 changed files with 8 additions and 0 deletions
  1. 8 0
      core/wma/src/wma_utils.c

+ 8 - 0
core/wma/src/wma_utils.c

@@ -520,6 +520,14 @@ int wma_profile_data_report_event_handler(void *handle, uint8_t *event_buf,
 	buf_ptr = buf_ptr + sizeof(wmi_wlan_profile_ctx_t) + WMI_TLV_HDR_SIZE;
 	profile_data = (wmi_wlan_profile_t *) buf_ptr;
 	entries = profile_ctx->bin_count;
+
+	if (entries > param_buf->num_profile_data) {
+		WMA_LOGE("FW bin count %d more than data %d in TLV hdr",
+			 entries,
+			 param_buf->num_profile_data);
+		return -EINVAL;
+	}
+
 	QDF_TRACE(QDF_MODULE_ID_WMA, QDF_TRACE_LEVEL_ERROR,
 				"Profile data stats\n");
 	QDF_TRACE(QDF_MODULE_ID_WMA, QDF_TRACE_LEVEL_ERROR,