samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacmn: Add check for buffer overflow and null pointer dereference

Browse Source 
There is a chance for null pointer dereference for
num_eht_user_info_valid and array out of bounds for eht_user_info.

Add checks for both the cases as it may cause crash.

Change-Id: Icb5235612a1225b9991c99519b5ee49536c577bc
CRs-Fixed: 3426873
This commit is contained in:
Aravind Kishore Sukla
2023-03-07 11:53:41 +05:30
committed by Madan Koyyalamudi
parent 9064b44469
commit a3a4e67eed
2 changed files with 6 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
qdf/linux/src/qdf_nbuf.c
View File

@@ -5120,7 +5120,9 @@ qdf_nbuf_update_radiotap_eht_flags(struct mon_rx_status *rx_status,
put_unaligned_le32(rx_status->eht_data[5], &rtap_buf[rtap_len]);
rtap_len += 4;
for (user = 0; user < rx_status->num_eht_user_info_valid; user++) {
for (user = 0; user < EHT_USER_INFO_LEN &&
rx_status->num_eht_user_info_valid &&
user < rx_status->num_eht_user_info_valid; user++) {
put_unaligned_le32(rx_status->eht_user_info[user],
&rtap_buf[rtap_len]);
rtap_len += 4;