From 3bcae3a9c04dd4de36b673dfaffe58e722092aa6 Mon Sep 17 00:00:00 2001 From: Nagalakshmi Date: Tue, 29 Nov 2022 22:48:35 -0800 Subject: [PATCH] qcacld-3.0: Fix OOB in wma_scan_roam.c Currently in wma_extscan_hotlist_match_event_handler API, dest_hotlist get memory allocation based on numap which takes value from event->total_entries. But numap is limited to WMA_EXTSCAN_MAX_HOTLIST_ENTRIES and event->total_entries more than WMA_EXTSCAN_MAX_HOTLIST_ENTRIES can cause out of bound issue. Fix is to populate dest_hotlist->numOfAps from numap instead of event->total_entries to avoid any out of bound issue. Change-Id: If8c5de81bec2cf2a1a6546a4319e41e9b07a139d CRs-Fixed: 3346781 Mot-CRs-fixed: (CR) CVE- fixed: CVE-2023-21656 QC-CR#3346781 Signed-off-by: Sipra Patel Change-Id: If8c5de81bec2cf2a1a6546a4319e41e9b07a139d Reviewed-on: https://gerrit.mot.com/2594249 SME-Granted: SME Approvals Granted SLTApproved: Slta Waiver Tested-by: Jira Key Reviewed-by: Zhengjie Zhu Reviewed-by: Bin Liu Submit-Approved: Jira Key --- core/wma/src/wma_scan_roam.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/wma/src/wma_scan_roam.c b/core/wma/src/wma_scan_roam.c index 32b57d9c4e50..dd596c4e7e4a 100644 --- a/core/wma/src/wma_scan_roam.c +++ b/core/wma/src/wma_scan_roam.c @@ -4965,7 +4965,7 @@ int wma_extscan_hotlist_match_event_handler(void *handle, return -ENOMEM; dest_ap = &dest_hotlist->ap[0]; - dest_hotlist->numOfAps = event->total_entries; + dest_hotlist->numOfAps = numap; dest_hotlist->requestId = event->config_request_id; if (event->first_entry_index +