Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 14d13b97 authored by Jianmin Zhu's avatar Jianmin Zhu Committed by Gerrit - the friendly Code Review server
Browse files

qcacmn: Fix possible OOB read in extract_hw_mode_cap_service_ready_ext_tlv

When WMI_SERVICE_READY_EXT_EVENT is received from firmware, the
function extract_hw_mode_cap_service_ready_ext_tlv is called to
update the soc caps and other capabilities to the host. hw_caps
is extracted directly from the param_buf value received from the
firmware and hw_caps->num_hw_modes is used to traverse
through the hw_mode_caps and update the values to it from the
param_buf->hw_mode_caps, need validate hw_caps->num_hw_modes and
param_buf->hw_mode_caps before use them.

Change-Id: I459f0afce7701ddf1d041912e3406643d27a7f9c
CRs-Fixed: 2336910
parent 958bdbd2
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment