Browse Source

qcacmn: Check to validate wmi tartget_type

This target type is used as an array index for wmi_attach_register.
If the index is greater than or equal to  WMI_MAX_TARGET_TYPE,
it may lead to invalid memory access.
KW issue id is 294041

Change-Id: Ibb49d77413517173c24aae44ae5a3f17069425d2
Abhiram Jogadenu 7 years ago
parent
commit
9c5c6132f6
1 changed files with 4 additions and 0 deletions
  1. 4 0
      wmi/src/wmi_unified.c

+ 4 - 0
wmi/src/wmi_unified.c

@@ -2193,6 +2193,10 @@ void *wmi_unified_attach(void *scn_handle,
 				param->rx_ops->wma_process_fw_event_handler_cbk;
 	wmi_handle->target_type = param->target_type;
 	soc->target_type = param->target_type;
+
+	if (param->target_type >= WMI_MAX_TARGET_TYPE)
+		goto error;
+
 	if (wmi_attach_register[param->target_type]) {
 		wmi_attach_register[param->target_type](wmi_handle);
 	} else {