Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9f65daf4 authored by Mohammed Javid's avatar Mohammed Javid Committed by Gerrit - the friendly Code Review server
Browse files

msm: ipa: rmnet_ipa: Fix array out of bounds 



Validate the device_type to avoid array out
of bound access.

Change-Id: Ib0ea1daf6c19fbf8d55257d9a58b2dadbaff9715
Signed-off-by: default avatarMohammed Javid <mjavid@codeaurora.org>
parent 51683be8

drivers/platform/msm/ipa/ipa_v3/rmnet_ipa.c

+7 −0
Original line number Diff line number Diff line
@@ -3706,6 +3706,13 @@ static inline int rmnet_ipa3_delete_lan_client_info 
	int i;

	struct ipa_tether_device_info *teth_ptr = NULL;



	/* Check if Device type is valid. */

	if (device_type >= IPACM_MAX_CLIENT_DEVICE_TYPES ||

		device_type < 0) {

		IPAWANERR("Invalid Device type: %d\n", device_type);

		return -EINVAL;

	}



	/* Check if the request is to clean up all clients. */

	teth_ptr = &rmnet_ipa3_ctx->tether_device[device_type];