浏览代码

qcacmn: Add array out of bound access checks

Add current AP power type check in reg_get_num_reg_rules and
reg_append_6g_reg_rules_in_pdev to avoid the array out of bound access
of pdev_priv_obj->num_of_6g_ap_reg_rules.

Change-Id: I769615788add14bd5892edf966981ba729073f17
CRs-Fixed: 3513759
Hariharan Basuthkar 2 年之前
父节点
当前提交
8943c4d969
共有 1 个文件被更改,包括 10 次插入0 次删除
  1. 10 0
      umac/regulatory/core/src/reg_build_chan_list.c

+ 10 - 0
umac/regulatory/core/src/reg_build_chan_list.c

@@ -3156,6 +3156,11 @@ static int reg_get_num_reg_rules(
 	struct reg_rule_info *pdev_reg_rules;
 
 	cur_6g_ap_pwr_type = pdev_priv_obj->reg_cur_6g_ap_pwr_type;
+	if (cur_6g_ap_pwr_type > REG_MAX_SUPP_AP_TYPE) {
+		reg_err("Unsupported 6G AP power type");
+		return 0;
+	}
+
 	pdev_reg_rules = &pdev_priv_obj->reg_rules;
 
 	return (pdev_reg_rules->num_of_reg_rules +
@@ -3220,6 +3225,11 @@ static void reg_append_6g_reg_rules_in_pdev(
 	uint8_t num_reg_rules;
 
 	cur_pwr_type = pdev_priv_obj->reg_cur_6g_ap_pwr_type;
+	if (cur_pwr_type > REG_MAX_SUPP_AP_TYPE) {
+		reg_err("Unsupported 6G AP power type");
+		return;
+	}
+
 	pdev_reg_rules = &pdev_priv_obj->reg_rules;
 
 	num_reg_rules = pdev_reg_rules->num_of_reg_rules;