samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacld-3.0: OOB access may occur due to total numChannels exceeds max value

Browse Source 
Out of Buffer access may occur in wmi_get_buf_extscan_start_cmd()
function if user provided inputs are different for below parameters
which are assigned in hdd_extscan_start_fill_bucket_channel_spec()
function

1. QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC_NUM_CHANNEL_SPECS
2. QCA_WLAN_VENDOR_ATTR_EXTSCAN_CHANNEL_SPEC

To address this issue return failure status if numChannels is not
equal to the total number of channel entries.

Change-Id: I60d74161dc3752bd7f609af3910d7c86a99488ec
CRs-Fixed: 2255189
This commit is contained in:
Dundi Raviteja
2018-06-12 18:31:43 +05:30
committed by nshrivas
parent 11767e756a
commit ab08adcec0
1 changed files with 5 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
core/hdd/src/wlan_hdd_ext_scan.c
View File

@@ -3042,6 +3042,11 @@ static int hdd_extscan_start_fill_bucket_channel_spec(
total_channels++; total_channels++;
} }
if (j != req_msg->buckets[bkt_index].numChannels) {
hdd_err("Input parameters didn't match");
return -EINVAL;
}
hdd_extscan_update_dwell_time_limits( hdd_extscan_update_dwell_time_limits(
req_msg, bkt_index, req_msg, bkt_index,
min_dwell_time_active_bucket, min_dwell_time_active_bucket,