Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 9f65daf4 authored by Mohammed Javid's avatar Mohammed Javid Committed by Gerrit - the friendly Code Review server
Browse files

msm: ipa: rmnet_ipa: Fix array out of bounds



Validate the device_type to avoid array out
of bound access.

Change-Id: Ib0ea1daf6c19fbf8d55257d9a58b2dadbaff9715
Signed-off-by: default avatarMohammed Javid <mjavid@codeaurora.org>
parent 51683be8
Loading
Loading
Loading
Loading
+7 −0
Original line number Diff line number Diff line
@@ -3706,6 +3706,13 @@ static inline int rmnet_ipa3_delete_lan_client_info
	int i;
	struct ipa_tether_device_info *teth_ptr = NULL;

	/* Check if Device type is valid. */
	if (device_type >= IPACM_MAX_CLIENT_DEVICE_TYPES ||
		device_type < 0) {
		IPAWANERR("Invalid Device type: %d\n", device_type);
		return -EINVAL;
	}

	/* Check if the request is to clean up all clients. */
	teth_ptr = &rmnet_ipa3_ctx->tether_device[device_type];