Procházet zdrojové kódy

qcacld-3.0: Validate regulatory channels

In function hdd_process_regulatory_data, array reg_channels is limited
by enum value NUM_CHANNELS. But there is no check on the index
to the reg_channels. This can lead to a buffer overflow situation.

Prevent buffer overflow for reg_channels by checking index
against NUM_CHANNELS.

Change-Id: I6050e6616e9bd6365943d2aaf8fbdb53a92f17d0
CRs-Fixed: 1083028
Manjeet Singh před 8 roky
rodič
revize
ec402065db
1 změnil soubory, kde provedl 2 přidání a 1 odebrání
  1. 2 1
      core/hdd/src/wlan_hdd_regulatory.c

+ 2 - 1
core/hdd/src/wlan_hdd_regulatory.c

@@ -387,7 +387,8 @@ static void hdd_process_regulatory_data(hdd_context_t *hdd_ctx,
 			continue;
 
 		for (chan_num = 0;
-		     chan_num < wiphy->bands[band_num]->n_channels;
+		     chan_num < wiphy->bands[band_num]->n_channels &&
+		     chan_enum < NUM_CHANNELS;
 		     chan_num++) {
 
 			wiphy_chan =