Преглед изворни кода

qcacld-3.0: Avoid OOB access of weight_list

Currently, function mlme_is_freq_present_in_list calculates
index based on chanel frequency in a loop of num_freq.
But acs_weight array can hold NUM_CHANNELS number of values.
loop index more than NUM_CHANNELS may lead to OOB read issue.

Fix is to add a validation for loop index < NUM_CHANNELS to
avoid any OOB issue.

Change-Id: I3c1d3393cd2a40147c325fea8f76b1db1a51f457
CRs-Fixed: 2727312
sheenam monga пре 4 година
родитељ
комит
baca2a3950
1 измењених фајлова са 2 додато и 2 уклоњено
  1. 2 2
      components/mlme/core/src/wlan_mlme_main.c

+ 2 - 2
components/mlme/core/src/wlan_mlme_main.c

@@ -1236,7 +1236,7 @@ mlme_is_freq_present_in_list(struct acs_weight *normalize_weight_chan_list,
 {
 	uint8_t i;
 
-	for (i = 0; i < num_freq; i++) {
+	for (i = 0; i < num_freq && i < NUM_CHANNELS; i++) {
 		if (normalize_weight_chan_list[i].chan_freq == freq) {
 			*index = i;
 			return true;
@@ -1292,7 +1292,7 @@ mlme_acs_parse_weight_list(struct wlan_objmgr_psoc *psoc,
 		} else {
 			sscanf(str1, "%d", &freq1);
 			strsep(&str1, "=");
-			if (!str1)
+			if (!str1 || !weight_list)
 				goto end;
 			sscanf(str1, "%d", &normalize_factor);
 			if (mlme_is_freq_present_in_list(weight_list,