浏览代码

qcacld-3.0: Add sanity check for vdev id to prevent OOB access

Add sanity check for vdev id in wma_vdev_start_resp_handler() to prevent
out of bound memory access.

Change-Id: Ia4e18e8e322142928c41dfa88b874ff017727266
CRs-Fixed: 2120424
Himanshu Agarwal 7 年之前
父节点
当前提交
dfca3d8173
共有 1 个文件被更改,包括 5 次插入0 次删除
  1. 5 0
      core/wma/src/wma_dev_if.c

+ 5 - 0
core/wma/src/wma_dev_if.c

@@ -960,6 +960,11 @@ int wma_vdev_start_resp_handler(void *handle, uint8_t *cmd_param_info,
 		return -EINVAL;
 	}
 
+	if (resp_event->vdev_id >= wma->max_bssid) {
+		WMA_LOGE("Invalid vdev id received from firmware");
+		return -EINVAL;
+	}
+
 	if (resp_event->status == QDF_STATUS_SUCCESS) {
 		wma->interfaces[resp_event->vdev_id].tx_streams =
 			resp_event->cfgd_tx_streams;