Prechádzať zdrojové kódy

qcacld-3.0: Fix potential buffer overflow

In the function sap_clear_session_param, sapctx->sessionId can have
value more than max value allowed for the array
mac_ctx->sap.sapCtxList.

Add sanity check for the variable sapctx->sessionId

Change-Id: I846a8a1435de63d0a2e34f23bc407e0a8fa53eb2
CRs-Fixed: 2162255
Sourav Mohapatra 7 rokov pred
rodič
commit
ab088faa4a
1 zmenil súbory, kde vykonal 3 pridanie a 0 odobranie
  1. 3 0
      core/sap/src/sap_fsm.c

+ 3 - 0
core/sap/src/sap_fsm.c

@@ -2079,6 +2079,9 @@ QDF_STATUS sap_clear_session_param(tHalHandle hal, struct sap_context *sapctx,
 {
 	tpAniSirGlobal mac_ctx = PMAC_STRUCT(hal);
 
+	if (sapctx->sessionId >= SAP_MAX_NUM_SESSION)
+		return QDF_STATUS_E_FAILURE;
+
 	mac_ctx->sap.sapCtxList[sapctx->sessionId].sessionID =
 		CSR_SESSION_ID_INVALID;
 	mac_ctx->sap.sapCtxList[sapctx->sessionId].pSapContext = NULL;