瀏覽代碼

qcacld-3.0: Validate regulatory channels

In function hdd_process_regulatory_data, array reg_channels is limited
by enum value NUM_CHANNELS. But there is no check on the index
to the reg_channels. This can lead to a buffer overflow situation.

Prevent buffer overflow for reg_channels by checking index
against NUM_CHANNELS.

Change-Id: I6050e6616e9bd6365943d2aaf8fbdb53a92f17d0
CRs-Fixed: 1083028
Manjeet Singh 8 年之前
父節點
當前提交
ec402065db
共有 1 個文件被更改,包括 2 次插入1 次删除
  1. 2 1
      core/hdd/src/wlan_hdd_regulatory.c

+ 2 - 1
core/hdd/src/wlan_hdd_regulatory.c

@@ -387,7 +387,8 @@ static void hdd_process_regulatory_data(hdd_context_t *hdd_ctx,
 			continue;
 
 		for (chan_num = 0;
-		     chan_num < wiphy->bands[band_num]->n_channels;
+		     chan_num < wiphy->bands[band_num]->n_channels &&
+		     chan_enum < NUM_CHANNELS;
 		     chan_num++) {
 
 			wiphy_chan =