qcacmn: add argument sanity check to avoid OOB

In function 'target_if_vdev_mgr_multi_vdev_restart_get_ref',
'param->num_vdevs' may have chance to hold values larger than
WLAN_UMAC_PDEV_MAX_VDEVS which will result in OOB
when access array 'vdev_list' and array 'vdev_timer_started'.

This change add sanity check for 'param->num_vdevs'to avoid
OOB.

Change-Id: Iae431fdc7006fe8c80d15d400d8a0423e9284eb7
CRs-Fixed: 2644122
This commit is contained in:
Rongjing Liao
2020-03-18 14:10:55 +08:00
committed by nshrivas
parent 018b298dba
commit a70123f9a2

View File

@@ -970,6 +970,12 @@ static QDF_STATUS target_if_vdev_mgr_multiple_vdev_restart_req_cmd(
return QDF_STATUS_E_INVAL;
}
if (param->num_vdevs > WLAN_UMAC_PDEV_MAX_VDEVS) {
mlme_err("param->num_vdevs: %u exceed the limit",
param->num_vdevs);
return QDF_STATUS_E_INVAL;
}
last_vdev_idx = target_if_vdev_mgr_multi_vdev_restart_get_ref(
pdev, param,
vdev_list,