소스 검색

qcacld-3.0: Add a limit check for total num powers

Currently there is no validaton for total num powers
which is calculated by adding powers sent by AP till
160 MHz and powers sent in ext element of the TPE IE.
total powers will increase more than allowed Tx powers
if AP sends some invalid value in ext count but array
limit is 15 only. which may become cause of out of
bound if AP sends some invalid value in ext count.

Fix is to add a validation check for total num powers.
If total num powers becaomes greater than allowed powers,
don't parse the ext element.

Change-Id: I1478b8d1dfa3c491a471790a12d0c3b0f62352f7
CRs-Fixed: 3695072
Sheenam Monga 1 년 전
부모
커밋
c3cb939a52
1개의 변경된 파일5개의 추가작업 그리고 1개의 파일을 삭제
  1. 5 1
      core/mac/src/pe/lim/lim_process_sme_req_messages.c

+ 5 - 1
core/mac/src/pe/lim/lim_process_sme_req_messages.c

@@ -5690,7 +5690,11 @@ lim_update_ext_tpe_power(struct mac_context *mac, struct pe_session *session,
 		}
 
 		total_psd_power = existing_pwr_count + ext_psd_count;
-
+		if (total_psd_power > MAX_NUM_PWR_LEVEL) {
+			pe_debug("total powers greater than max %d",
+				 MAX_NUM_PWR_LEVEL);
+			return existing_pwr_count;
+		}
 		i = existing_pwr_count;
 		for (j = 0; j < ext_psd_count && i < total_psd_power; j++)
 		{