瀏覽代碼

qcacld-3.0: Validate number of bytes before memory allocation

Currently, In function hdd_get_roam_scan_ch_cb memory
is allocated for event response buffer for invalid len.

Fix is to add a validation check for len before alloction
of memory to avoid memory allocation for invalid len.

Change-Id: I14cffdace868fc19358322c36dd2589d7845b8fa
CRs-Fixed: 2640114
sheenam monga 5 年之前
父節點
當前提交
a89f7ed3a3
共有 1 個文件被更改,包括 4 次插入0 次删除
  1. 4 0
      core/hdd/src/wlan_hdd_ioctl.c

+ 4 - 0
core/hdd/src/wlan_hdd_ioctl.c

@@ -4025,6 +4025,10 @@ void hdd_get_roam_scan_ch_cb(hdd_handle_t hdd_handle,
 	 */
 	if (!roam_ch->command_resp) {
 		len = roam_ch->num_channels * sizeof(roam_ch->chan_list[0]);
+		if (!len) {
+			hdd_err("Invalid len");
+			return;
+		}
 		event = (uint8_t *)qdf_mem_malloc(len);
 		if (!event) {
 			hdd_err("Failed to alloc event response buf vdev_id: %d",