Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5d863d97 authored by Huashan Qu's avatar Huashan Qu Committed by Madan Koyyalamudi
Browse files

qcacld-3.0: Add check to avoid potential OOB access for bssid_list

In wma_group_num_bss_to_scan_id(), bssid_list may be accessed out
of boundary.

Add check to avoid potential OOB access for bssid_list.

Change-Id: I218af0fe617f64a50c7c296c622f7fac01e1b4fc
CRs-Fixed: 3357461
parent 92424811
Loading
Loading
Loading
Loading
+13 −10
Original line number Diff line number Diff line
/*
 * Copyright (c) 2013-2021 The Linux Foundation. All rights reserved.
 * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.
 * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
 *
 * Permission to use, copy, modify, and/or distribute this software for
 * any purpose with or without fee is hereby granted, provided that the
@@ -3730,6 +3730,7 @@ static int wma_group_num_bss_to_scan_id(const u_int8_t *cmd_param_info,
	struct extscan_cached_scan_results *t_cached_result;
	struct extscan_cached_scan_result *t_scan_id_grp;
	int i, j;
	uint32_t total_scan_num_results = 0;
	tSirWifiScanResult *ap;

	param_buf = (WMI_EXTSCAN_CACHED_RESULTS_EVENTID_param_tlvs *)
@@ -3740,16 +3741,19 @@ static int wma_group_num_bss_to_scan_id(const u_int8_t *cmd_param_info,
	t_cached_result = cached_result;
	t_scan_id_grp = &t_cached_result->result[0];

	if ((t_cached_result->num_scan_ids *
	     QDF_MIN(t_scan_id_grp->num_results,
		     param_buf->num_bssid_list)) > param_buf->num_bssid_list) {
		wma_err("num_scan_ids %d, num_results %d num_bssid_list %d",
			 t_cached_result->num_scan_ids,
			 t_scan_id_grp->num_results,
	for (i = 0; i < t_cached_result->num_scan_ids; i++) {
		total_scan_num_results += t_scan_id_grp->num_results;
		t_scan_id_grp++;
	}

	if (total_scan_num_results > param_buf->num_bssid_list) {
		wma_err("total_scan_num_results %d, num_bssid_list %d",
			total_scan_num_results,
			param_buf->num_bssid_list);
		return -EINVAL;
	}

	t_scan_id_grp = &t_cached_result->result[0];
	wma_debug("num_scan_ids:%d",
			t_cached_result->num_scan_ids);
	for (i = 0; i < t_cached_result->num_scan_ids; i++) {
@@ -3760,8 +3764,7 @@ static int wma_group_num_bss_to_scan_id(const u_int8_t *cmd_param_info,
			return -ENOMEM;

		ap = &t_scan_id_grp->ap[0];
		for (j = 0; j < QDF_MIN(t_scan_id_grp->num_results,
					param_buf->num_bssid_list); j++) {
		for (j = 0; j < t_scan_id_grp->num_results; j++) {
			ap->channel = src_hotlist->channel;
			ap->ts = WMA_MSEC_TO_USEC(src_rssi->tstamp);
			ap->rtt = src_hotlist->rtt;