فهرست منبع

qcacld-3.0: Validate regulatory channels

In function hdd_process_regulatory_data, array reg_channels is limited
by enum value NUM_CHANNELS. But there is no check on the index
to the reg_channels. This can lead to a buffer overflow situation.

Prevent buffer overflow for reg_channels by checking index
against NUM_CHANNELS.

Change-Id: I6050e6616e9bd6365943d2aaf8fbdb53a92f17d0
CRs-Fixed: 1083028
Manjeet Singh 8 سال پیش
والد
کامیت
ec402065db
1فایلهای تغییر یافته به همراه2 افزوده شده و 1 حذف شده
  1. 2 1
      core/hdd/src/wlan_hdd_regulatory.c

+ 2 - 1
core/hdd/src/wlan_hdd_regulatory.c

@@ -387,7 +387,8 @@ static void hdd_process_regulatory_data(hdd_context_t *hdd_ctx,
 			continue;
 
 		for (chan_num = 0;
-		     chan_num < wiphy->bands[band_num]->n_channels;
+		     chan_num < wiphy->bands[band_num]->n_channels &&
+		     chan_enum < NUM_CHANNELS;
 		     chan_num++) {
 
 			wiphy_chan =