瀏覽代碼

qcacmn: Discard QMI events when message with invalid length

Currently QMI message length is not being validated before
handling QMI event. This is resulting in illegal memory access
when QMI message length is invalid.

To address this, discard QMI events with invalid length.

Change-Id: Ia9f04bcb4fa3b365cbbf2be8885a8d30f78f8f10
CRs-Fixed: 2839277
Bapiraju Alla 4 年之前
父節點
當前提交
debcd9c86d
共有 1 個文件被更改,包括 1 次插入1 次删除
  1. 1 1
      wmi/src/wmi_unified.c

+ 1 - 1
wmi/src/wmi_unified.c

@@ -2580,7 +2580,7 @@ static int __wmi_process_qmi_fw_event(void *wmi_cb_ctx, void *buf, int len)
 	uint32_t evt_id;
 	int wmi_msg_len;
 
-	if (!wmi_handle || !buf)
+	if (!wmi_handle || !buf || (len < WMI_MIN_HEAD_ROOM))
 		return -EINVAL;
 
 	/**