duff/android_kernel_motorola_sm6225
1
0 Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacld-3.0: Fix OOB in wma_scan_roam.c

Browse Source 
Currently in wma_extscan_hotlist_match_event_handler
API, dest_hotlist get memory allocation based on numap
which takes value from event->total_entries.
But numap is limited to WMA_EXTSCAN_MAX_HOTLIST_ENTRIES
and event->total_entries more than WMA_EXTSCAN_MAX_HOTLIST_ENTRIES
can cause out of bound issue.

Fix is to populate dest_hotlist->numOfAps from numap
instead of event->total_entries to avoid any out of bound issue.

Change-Id: If8c5de81bec2cf2a1a6546a4319e41e9b07a139d
CRs-Fixed: 3346781

Mot-CRs-fixed: (CR)
CVE- fixed: CVE-2023-21656
QC-CR#3346781
Signed-off-by: Sipra Patel <siprap@motorola.com>
Change-Id: If8c5de81bec2cf2a1a6546a4319e41e9b07a139d
Reviewed-on: https://gerrit.mot.com/2594249
SME-Granted: SME Approvals Granted
SLTApproved: Slta Waiver
Tested-by: Jira Key
Reviewed-by: Zhengjie Zhu <zhuzj5@motorola.com>
Reviewed-by: Bin Liu <liubin7@motorola.com>
Submit-Approved: Jira Key
This commit is contained in:
Nagalakshmi authored and Marcelo Bissaro committed 2023-11-29 02:24:01 -06:00
1 parent 1e47c80fe3
commit 3bcae3a9c0
1 file changed
+1 -1
Download Patch File Download Diff File Expand all files Collapse all files
core/wma/src/wma_scan_roam.c
+1 -1
View File
@@ -4965,7 +4965,7 @@ int wma_extscan_hotlist_match_event_handler(void *handle,
return -ENOMEM; return -ENOMEM;
dest_ap = &dest_hotlist->ap[0]; dest_ap = &dest_hotlist->ap[0];
dest_hotlist->numOfAps = event->total_entries; dest_hotlist->numOfAps = numap;
dest_hotlist->requestId = event->config_request_id; dest_hotlist->requestId = event->config_request_id;
if (event->first_entry_index + if (event->first_entry_index +