Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 41a3e8ee authored by Harprit Chhabada's avatar Harprit Chhabada Committed by Gerrit - the friendly Code Review server
Browse files

qcacmn: Add bound check for desc_id 

Add bound check for desc_id in tgt_mgmt_txrx_tx_completion_handler()
to check OOB issue.

Change-Id: Ib28852a1c1ccf06af14004bf4001ce0938391f3d
CRs-Fixed: 2318632
parent 372c1779

umac/cmn_services/mgmt_txrx/dispatcher/src/wlan_mgmt_txrx_tgt_api.c

+4 −0
Original line number Diff line number Diff line
@@ -1025,6 +1025,10 @@ QDF_STATUS tgt_mgmt_txrx_tx_completion_handler( 
		mgmt_txrx_err("Mgmt txrx context empty for pdev %pK", pdev);

		return QDF_STATUS_E_NULL_VALUE;

	}

	if (desc_id >= MGMT_DESC_POOL_MAX) {

		mgmt_txrx_err("desc_id:%u is out of bounds", desc_id);

		return QDF_STATUS_E_INVAL;

	}

	mgmt_desc = &mgmt_txrx_pdev_ctx->mgmt_desc_pool.pool[desc_id];

	if (!mgmt_desc) {

		mgmt_txrx_err("Mgmt desc empty for id %d pdev %pK ",