浏览代码

qcacld-3.0: Add check to avoid OOB access

Currently while updating EAPOL stats, there is no check
for subtype greater than array size, which can result in OOB access.

To fix the issue add additional check for subtype <= EAPOL M4 to
avoid OOB access.

Change-Id: I906ce9166b7a0202335403c77dc6bcd135dea663
CRs-Fixed: 3387939
Amit Mehta 2 年之前
父节点
当前提交
7297c338d7
共有 1 个文件被更改,包括 2 次插入1 次删除
  1. 2 1
      components/dp/core/src/wlan_dp_txrx.c

+ 2 - 1
components/dp/core/src/wlan_dp_txrx.c

@@ -796,7 +796,8 @@ void dp_sta_notify_tx_comp_cb(qdf_nbuf_t nbuf, void *ctx, uint16_t flag)
 	case QDF_NBUF_CB_PACKET_TYPE_EAPOL:
 		subtype = qdf_nbuf_get_eapol_subtype(nbuf);
 		if (!(flag & BIT(QDF_TX_RX_STATUS_OK)) &&
-		    subtype != QDF_PROTO_INVALID)
+		    subtype != QDF_PROTO_INVALID &&
+		    subtype <= QDF_PROTO_EAPOL_M4)
 			++dp_intf->dp_stats.eapol_stats.
 				tx_noack_cnt[subtype - QDF_PROTO_EAPOL_M1];
 		break;