Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit e2e7af2e authored by chunquan's avatar chunquan Committed by Madan Koyyalamudi
Browse files

qcacmn: Fetch thermal_stats in array range 

Since lvl_idx maybe get value large than
param_buf->num_temp_range_stats, then out
of bounds will happen when read array of
wmi_tt_stats.

Change-Id: I85b29216272952102dca41792c290baf285a8e31
CRs-Fixed: 3136333
parent 48de2db9

wmi/src/wmi_unified_tlv.c

+7 −0
Original line number Diff line number Diff line
@@ -11500,6 +11500,13 @@ populate_thermal_stats(WMI_THERM_THROT_STATS_EVENTID_param_tlvs *param_buf, 
			       WMI_THERMAL_STATS_TEMP_THRESH_LEVEL_MAX :

			       tt_stats_event->therm_throt_levels;



	if (*therm_throt_levels > param_buf->num_temp_range_stats) {

		wmi_err("therm_throt_levels:%u oob num_temp_range_stats:%u",

			*therm_throt_levels,

			param_buf->num_temp_range_stats);

		return;

	}



	wmi_tt_stats = param_buf->temp_range_stats;

	if (!wmi_tt_stats) {

		wmi_err("wmi_tt_stats Null");