qcacld-3.0: Avoid OOB in function tdls_ct_idle_handler

In function tdls_ct_idle_handler, idx is assigned from
tdls_info->index which can be 0 254. But tdls_conn_info
is static array in tdls_soc_priv_obj of size
WLAN_TDLS_STA_MAX_NUM (8). So check idx is less than
WLAN_TDLS_STA_MAX_NUM or not to avoid OOB memory access.

Change-Id: I8387cb0a44a79f0f83b25c12de2aa9fbc39ab2f3
CRs-Fixed: 2474432
This commit is contained in:
Bala Venkatesh
2019-06-18 19:35:16 +05:30
gecommit door nshrivas
bovenliggende db24dda371
commit 4e3f275a80

Bestand weergeven

@@ -639,7 +639,7 @@ void tdls_ct_idle_handler(void *user_data)
return;
idx = tdls_info->index;
if (tdls_info->index == INVALID_TDLS_PEER_INDEX)
if (idx == INVALID_TDLS_PEER_INDEX || idx >= WLAN_TDLS_STA_MAX_NUM)
return;
tdls_soc_obj = qdf_container_of(tdls_info, struct tdls_soc_priv_obj,