Browse Source

qcacld-3.0: Add sanity check for total_peer_len in wma_get_ll_stats_ext_buf

Add additional sanity checks for total_peer_len in wma_get_ll_stats_ext_buf.
Missing changes for CLD3.2 from I2689873c2c5e63c83e5059563662c0c69dc659fc

Change-Id: I6f82c9ef251e0290f9cf68e9fcd2d8868a5a302c
CRs-Fixed: 2121194
Vignesh Viswanathan 7 years ago
parent
commit
ca67e368a2
1 changed files with 6 additions and 3 deletions
  1. 6 3
      core/wma/src/wma_utils.c

+ 6 - 3
core/wma/src/wma_utils.c

@@ -767,9 +767,12 @@ static tSirLLStatsResults *wma_get_ll_stats_ext_buf(uint32_t *len,
 					 (sizeof(struct sir_wifi_tx) +
 					 sizeof(struct sir_wifi_rx)));
 		}
-		if (peer_num > (WMI_SVC_MSG_MAX_SIZE /
-				(sizeof(struct sir_wifi_ll_ext_peer_stats) +
-				total_peer_len))) {
+		if (total_peer_len > WMI_SVC_MSG_MAX_SIZE) {
+			excess_data = true;
+			break;
+		}
+		if (peer_num > (WMI_SVC_MSG_MAX_SIZE - total_peer_len) /
+				sizeof(struct sir_wifi_ll_ext_peer_stats)) {
 			excess_data = true;
 			break;
 		} else {