qcacmn: Fix possible OOB in target_if_direct_buf_rx_rsp_event_handler
The function target_if_direct_buf_rx_rsp_event_handler() handles the WMI_PDEV_DMA_RING_BUF_RELEASE_EVENTID event from target. This function calls extract_dbr_buf_release_fixed_tlv() to copy the module id, pdev id number of buffer release entry and number of meta data release entries. The value of module id is used to index the array dbr_mod_param to get the value of mod_param. So if the module id value greater than dbr_pdev_obj->num_modules could result in possible OOB. Validate mod_id received in the fixed param of the event WMI_PDEV_DMA_RING_BUF_RELEASE_EVENTID against dbr_pdev_obj->num_modules. Change-Id: I1c2c0a2a9c98d8b787496aba7a7c4f8fd781de16 CRs-Fixed: 2428798
Loading
Please register or sign in to comment