Browse Source

qcacld-3.0: Out of bound access while fetching disabled ml links

Host driver tries to fetch info of disabled ML links from
pm_disabled_ml_links by passing arrays to fill vdev_id_list,
freq_list and ml_idx list. Disabled + enabled links together can't be
more than MAX_NUMBER_OF_CONC_CONNECTIONS from functionality perspective.
But static analyzer tool complains that there are chances for out of
bound access of the given arrays while filling the indexes. Add checks to
avoid any such possible out bound access.

Change-Id: Icff77f9700c782f05e10c1d0aee8e1f238b0cc94
CRs-Fixed: 3344532
Rahul Gusain 2 năm trước cách đây
mục cha
commit
f4dcdbd94b

+ 6 - 0
components/cmn_services/policy_mgr/src/wlan_policy_mgr_get_set_utils.c

@@ -5600,6 +5600,12 @@ policy_mgr_get_disabled_ml_sta_idx(struct wlan_objmgr_psoc *psoc,
 			continue;
 		if (pm_disabled_ml_links[conn_index].mode != PM_STA_MODE)
 			continue;
+		if ((fill_index >= MAX_NUMBER_OF_CONC_CONNECTIONS) ||
+		    (*ml_sta >= MAX_NUMBER_OF_CONC_CONNECTIONS)) {
+			policy_mgr_err("Invalid fill_index: %d or ml_sta: %d",
+				       fill_index, *ml_sta);
+			break;
+		}
 		vdev_id_list[fill_index] =
 				pm_disabled_ml_links[conn_index].vdev_id;
 		freq_list[fill_index] = pm_disabled_ml_links[conn_index].freq;