samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacmn: Check for buffer overflow in event handler

Browse Source 
Check for buffer overflow in send_log_supported_evt_cmd_tlv.

Change-Id: Ib4850ce1a7abb77025a0dc8a3cc9776f6550eb9e
CRs-Fixed: 2122746
This commit is contained in:
Amar Singhal
2017-10-03 13:00:29 -07:00
committed by snandini
parent 22a0298e36
commit 5593c900b7
1 changed files with 10 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
wmi_unified_tlv.c
View File

@@ -11874,6 +11874,7 @@ send_mcast_group_update_cmd_tlv(wmi_unified_t wmi_handle,
WMI_CHAR_ARRAY_TO_MAC_ADDR(param->ucast_mac_addr, WMI_CHAR_ARRAY_TO_MAC_ADDR(param->ucast_mac_addr,
&cmd->ucast_mac_addr); &cmd->ucast_mac_addr);
} }
if (param->mcast_ip_addr) { if (param->mcast_ip_addr) {
QDF_ASSERT(param->mcast_ip_addr_bytes <= QDF_ASSERT(param->mcast_ip_addr_bytes <=
sizeof(cmd->mcast_ip_addr)); sizeof(cmd->mcast_ip_addr));
@@ -12784,6 +12785,15 @@ static QDF_STATUS send_log_supported_evt_cmd_tlv(wmi_unified_t wmi_handle,
} }
wmi_event = param_buf->fixed_param; wmi_event = param_buf->fixed_param;
num_of_diag_events_logs = wmi_event->num_of_diag_events_logs; num_of_diag_events_logs = wmi_event->num_of_diag_events_logs;
if (num_of_diag_events_logs >
param_buf->num_diag_events_logs_list) {
WMI_LOGE("message number of events %d is more than tlv hdr content %d",
num_of_diag_events_logs,
param_buf->num_diag_events_logs_list);
return QDF_STATUS_E_INVAL;
}
evt_args = param_buf->diag_events_logs_list; evt_args = param_buf->diag_events_logs_list;
if (!evt_args) { if (!evt_args) {
WMI_LOGE("%s: Event list is empty, num_of_diag_events_logs=%d", WMI_LOGE("%s: Event list is empty, num_of_diag_events_logs=%d",