Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 5d863d97 authored by Huashan Qu's avatar Huashan Qu Committed by Madan Koyyalamudi
Browse files

qcacld-3.0: Add check to avoid potential OOB access for bssid_list 

In wma_group_num_bss_to_scan_id(), bssid_list may be accessed out
of boundary.

Add check to avoid potential OOB access for bssid_list.

Change-Id: I218af0fe617f64a50c7c296c622f7fac01e1b4fc
CRs-Fixed: 3357461
parent 92424811

core/wma/src/wma_scan_roam.c

+13 −10
Original line number Diff line number Diff line 
/*

 * Copyright (c) 2013-2021 The Linux Foundation. All rights reserved.

 * Copyright (c) 2022 Qualcomm Innovation Center, Inc. All rights reserved.

 * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.

 *

 * Permission to use, copy, modify, and/or distribute this software for

 * any purpose with or without fee is hereby granted, provided that the
@@ -3730,6 +3730,7 @@ static int wma_group_num_bss_to_scan_id(const u_int8_t *cmd_param_info, 
	struct extscan_cached_scan_results *t_cached_result;

	struct extscan_cached_scan_result *t_scan_id_grp;

	int i, j;

	uint32_t total_scan_num_results = 0;

	tSirWifiScanResult *ap;



	param_buf = (WMI_EXTSCAN_CACHED_RESULTS_EVENTID_param_tlvs *)
@@ -3740,16 +3741,19 @@ static int wma_group_num_bss_to_scan_id(const u_int8_t *cmd_param_info, 
	t_cached_result = cached_result;

	t_scan_id_grp = &t_cached_result->result[0];



	if ((t_cached_result->num_scan_ids *

	     QDF_MIN(t_scan_id_grp->num_results,

		     param_buf->num_bssid_list)) > param_buf->num_bssid_list) {

		wma_err("num_scan_ids %d, num_results %d num_bssid_list %d",

			 t_cached_result->num_scan_ids,

			 t_scan_id_grp->num_results,

	for (i = 0; i < t_cached_result->num_scan_ids; i++) {

		total_scan_num_results += t_scan_id_grp->num_results;

		t_scan_id_grp++;

	}



	if (total_scan_num_results > param_buf->num_bssid_list) {

		wma_err("total_scan_num_results %d, num_bssid_list %d",

			total_scan_num_results,

			param_buf->num_bssid_list);

		return -EINVAL;

	}



	t_scan_id_grp = &t_cached_result->result[0];

	wma_debug("num_scan_ids:%d",

			t_cached_result->num_scan_ids);

	for (i = 0; i < t_cached_result->num_scan_ids; i++) {
@@ -3760,8 +3764,7 @@ static int wma_group_num_bss_to_scan_id(const u_int8_t *cmd_param_info, 
			return -ENOMEM;



		ap = &t_scan_id_grp->ap[0];

		for (j = 0; j < QDF_MIN(t_scan_id_grp->num_results,

					param_buf->num_bssid_list); j++) {

		for (j = 0; j < t_scan_id_grp->num_results; j++) {

			ap->channel = src_hotlist->channel;

			ap->ts = WMA_MSEC_TO_USEC(src_rssi->tstamp);

			ap->rtt = src_hotlist->rtt;