samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacmn: Fix out-of-bounds write in htc_add_receive_pkt_multiple

Browse Source 
In htc_add_receive_pkt_multiple, out-of-bounds write to a buffer.
Fix by checking the endpoint against the max endpoint.

Change-Id: Iaa82c7e8f3ae59f007380a7697959dd79dfb81ed
CRs-Fixed: 2232836
This commit is contained in:
Yun Park
2018-06-05 12:06:27 -07:00
committed by nshrivas
parent 890818bd02
commit ed2a224ba2
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
htc/htc_recv.c
View File

@@ -518,7 +518,10 @@ A_STATUS htc_add_receive_pkt_multiple(HTC_HANDLE HTCHandle,
return A_EINVAL; return A_EINVAL;
} }
AR_DEBUG_ASSERT(pFirstPacket->Endpoint < ENDPOINT_MAX); if (pFirstPacket->Endpoint >= ENDPOINT_MAX) {
A_ASSERT(false);
return A_EINVAL;
}
AR_DEBUG_PRINTF(ATH_DEBUG_RECV, AR_DEBUG_PRINTF(ATH_DEBUG_RECV,
("+- htc_add_receive_pkt_multiple : endPointId: %d, cnt:%d, length: %d\n", ("+- htc_add_receive_pkt_multiple : endPointId: %d, cnt:%d, length: %d\n",