浏览代码

qcacmn: add argument sanity check to avoid OOB

In function 'target_if_vdev_mgr_multi_vdev_restart_get_ref',
'param->num_vdevs' may have chance to hold values larger than
WLAN_UMAC_PDEV_MAX_VDEVS which will result in OOB
when access array 'vdev_list' and array 'vdev_timer_started'.

This change add sanity check for 'param->num_vdevs'to avoid
OOB.

Change-Id: Iae431fdc7006fe8c80d15d400d8a0423e9284eb7
CRs-Fixed: 2644122
Rongjing Liao 5 年之前
父节点
当前提交
a70123f9a2
共有 1 个文件被更改,包括 6 次插入0 次删除
  1. 6 0
      target_if/mlme/vdev_mgr/src/target_if_vdev_mgr_tx_ops.c

+ 6 - 0
target_if/mlme/vdev_mgr/src/target_if_vdev_mgr_tx_ops.c

@@ -970,6 +970,12 @@ static QDF_STATUS target_if_vdev_mgr_multiple_vdev_restart_req_cmd(
 		return QDF_STATUS_E_INVAL;
 	}
 
+	if (param->num_vdevs > WLAN_UMAC_PDEV_MAX_VDEVS) {
+		mlme_err("param->num_vdevs: %u exceed the limit",
+			 param->num_vdevs);
+		return QDF_STATUS_E_INVAL;
+	}
+
 	last_vdev_idx = target_if_vdev_mgr_multi_vdev_restart_get_ref(
 							pdev, param,
 							vdev_list,