diff options
| author | Hsiu-Chang Chen <hsiuchangchen@google.com> | 2022-12-19 17:44:22 +0800 |
|---|---|---|
| committer | Hsiu-Chang Chen <hsiuchangchen@google.com> | 2023-05-05 05:40:01 +0000 |
| commit | 37069247f0e647006e8f78b42c9948aaf2be1803 (patch) | |
| tree | 26356fbe725db541c2d594a843e38f88ff60294d | |
| parent | 01d8a2e22e6699b9575810ca48aa74a01124bf7d (diff) | |
| download | wlan-37069247f0e647006e8f78b42c9948aaf2be1803.tar.gz | |
qcacld-3.0: Add check to avoid potential OOB access for bssid_list
In wma_group_num_bss_to_scan_id(), bssid_list may be accessed out
of boundary.
Add check to avoid potential OOB access for bssid_list.
Bug: 245789946
Test: Regression Test
Change-Id: I218af0fe617f64a50c7c296c622f7fac01e1b4fc
CRs-Fixed: 3357461
Signed-off-by: Hsiu-Chang Chen <hsiuchangchen@google.com>
| -rw-r--r-- | qcacld-3.0/core/wma/src/wma_scan_roam.c | 21 |
1 files changed, 12 insertions, 9 deletions
diff --git a/qcacld-3.0/core/wma/src/wma_scan_roam.c b/qcacld-3.0/core/wma/src/wma_scan_roam.c index 9b0fd2f..65a358f 100644 --- a/qcacld-3.0/core/wma/src/wma_scan_roam.c +++ b/qcacld-3.0/core/wma/src/wma_scan_roam.c @@ -1749,6 +1749,7 @@ static int wma_group_num_bss_to_scan_id(const u_int8_t *cmd_param_info, struct extscan_cached_scan_results *t_cached_result; struct extscan_cached_scan_result *t_scan_id_grp; int i, j; + uint32_t total_scan_num_results = 0; tSirWifiScanResult *ap; param_buf = (WMI_EXTSCAN_CACHED_RESULTS_EVENTID_param_tlvs *) @@ -1759,16 +1760,19 @@ static int wma_group_num_bss_to_scan_id(const u_int8_t *cmd_param_info, t_cached_result = cached_result; t_scan_id_grp = &t_cached_result->result[0]; - if ((t_cached_result->num_scan_ids * - QDF_MIN(t_scan_id_grp->num_results, - param_buf->num_bssid_list)) > param_buf->num_bssid_list) { - wma_err("num_scan_ids %d, num_results %d num_bssid_list %d", - t_cached_result->num_scan_ids, - t_scan_id_grp->num_results, - param_buf->num_bssid_list); + for (i = 0; i < t_cached_result->num_scan_ids; i++) { + total_scan_num_results += t_scan_id_grp->num_results; + t_scan_id_grp++; + } + + if (total_scan_num_results > param_buf->num_bssid_list) { + wma_err("total_scan_num_results %d, num_bssid_list %d", + total_scan_num_results, + param_buf->num_bssid_list); return -EINVAL; } + t_scan_id_grp = &t_cached_result->result[0]; wma_debug("num_scan_ids:%d", t_cached_result->num_scan_ids); for (i = 0; i < t_cached_result->num_scan_ids; i++) { @@ -1779,8 +1783,7 @@ static int wma_group_num_bss_to_scan_id(const u_int8_t *cmd_param_info, return -ENOMEM; ap = &t_scan_id_grp->ap[0]; - for (j = 0; j < QDF_MIN(t_scan_id_grp->num_results, - param_buf->num_bssid_list); j++) { + for (j = 0; j < t_scan_id_grp->num_results; j++) { ap->channel = src_hotlist->channel; ap->ts = WMA_MSEC_TO_USEC(src_rssi->tstamp); ap->rtt = src_hotlist->rtt; |