瀏覽代碼

qcacld-3.0: Fix potential buffer overflow

In the function sap_clear_session_param, sapctx->sessionId can have
value more than max value allowed for the array
mac_ctx->sap.sapCtxList.

Add sanity check for the variable sapctx->sessionId

Change-Id: I846a8a1435de63d0a2e34f23bc407e0a8fa53eb2
CRs-Fixed: 2162255
Sourav Mohapatra 7 年之前
父節點
當前提交
ab088faa4a
共有 1 個文件被更改,包括 3 次插入0 次删除
  1. 3 0
      core/sap/src/sap_fsm.c

+ 3 - 0
core/sap/src/sap_fsm.c

@@ -2079,6 +2079,9 @@ QDF_STATUS sap_clear_session_param(tHalHandle hal, struct sap_context *sapctx,
 {
 	tpAniSirGlobal mac_ctx = PMAC_STRUCT(hal);
 
+	if (sapctx->sessionId >= SAP_MAX_NUM_SESSION)
+		return QDF_STATUS_E_FAILURE;
+
 	mac_ctx->sap.sapCtxList[sapctx->sessionId].sessionID =
 		CSR_SESSION_ID_INVALID;
 	mac_ctx->sap.sapCtxList[sapctx->sessionId].pSapContext = NULL;