Browse Source

qcacmn: Fix potential buffer overflow in process_tx_info

Check for buffer overflow for pktlog messages in process_tx_info
function before doing mem copy.

Change-Id: I5d34bfdecb4fd9dad1741da2256873ef3e9e708c
CRs-Fixed: 2154974
Poddar, Siddarth 7 years ago
parent
commit
7055c33bdb
1 changed files with 4 additions and 0 deletions
  1. 4 0
      utils/pktlog/pktlog_internal.c

+ 4 - 0
utils/pktlog/pktlog_internal.c

@@ -514,6 +514,10 @@ A_STATUS process_tx_info(struct ol_txrx_pdev_t *txrx_pdev, void *data)
 		 */
 		txctl_log.priv.frm_hdr = frm_hdr;
 		qdf_assert(txctl_log.priv.txdesc_ctl);
+		qdf_assert(pl_hdr.size < sizeof(txctl_log.priv.txdesc_ctl));
+		pl_hdr.size = (pl_hdr.size > sizeof(txctl_log.priv.txdesc_ctl))
+			       ? sizeof(txctl_log.priv.txdesc_ctl) :
+			       pl_hdr.size;
 		qdf_mem_copy((void *)&txctl_log.priv.txdesc_ctl,
 			     ((void *)data + sizeof(struct ath_pktlog_hdr)),
 			     pl_hdr.size);