qcacmn: add argument sanity check to avoid OOB
In function 'target_if_vdev_mgr_multi_vdev_restart_get_ref', 'param->num_vdevs' may have chance to hold values larger than WLAN_UMAC_PDEV_MAX_VDEVS which will result in OOB when access array 'vdev_list' and array 'vdev_timer_started'. This change add sanity check for 'param->num_vdevs'to avoid OOB. Change-Id: Iae431fdc7006fe8c80d15d400d8a0423e9284eb7 CRs-Fixed: 2644122
This commit is contained in:
@@ -970,6 +970,12 @@ static QDF_STATUS target_if_vdev_mgr_multiple_vdev_restart_req_cmd(
|
||||
return QDF_STATUS_E_INVAL;
|
||||
}
|
||||
|
||||
if (param->num_vdevs > WLAN_UMAC_PDEV_MAX_VDEVS) {
|
||||
mlme_err("param->num_vdevs: %u exceed the limit",
|
||||
param->num_vdevs);
|
||||
return QDF_STATUS_E_INVAL;
|
||||
}
|
||||
|
||||
last_vdev_idx = target_if_vdev_mgr_multi_vdev_restart_get_ref(
|
||||
pdev, param,
|
||||
vdev_list,
|
||||
|
Reference in New Issue
Block a user