diff options
| author | Poddar, Siddarth <siddpodd@codeaurora.org> | 2017-12-07 11:43:43 +0530 |
|---|---|---|
| committer | snandini <snandini@codeaurora.org> | 2017-12-09 15:44:41 -0800 |
| commit | 7055c33bdbcad5b86164c6956fca6a9b60ae2903 (patch) | |
| tree | cf8037bf38638b208057f690dc6cb57490a25ee3 /utils | |
| parent | ce2432138467d2f7b8799fb4f95fd91f1e9e2e99 (diff) | |
| download | qca-wfi-host-cmn-7055c33bdbcad5b86164c6956fca6a9b60ae2903.tar.gz | |
qcacmn: Fix potential buffer overflow in process_tx_info
Check for buffer overflow for pktlog messages in process_tx_info
function before doing mem copy.
Change-Id: I5d34bfdecb4fd9dad1741da2256873ef3e9e708c
CRs-Fixed: 2154974
Diffstat (limited to 'utils')
| -rw-r--r-- | utils/pktlog/pktlog_internal.c | 4 |
1 files changed, 4 insertions, 0 deletions
diff --git a/utils/pktlog/pktlog_internal.c b/utils/pktlog/pktlog_internal.c index 3e819d1f2..7dd4e0af2 100644 --- a/utils/pktlog/pktlog_internal.c +++ b/utils/pktlog/pktlog_internal.c @@ -514,6 +514,10 @@ A_STATUS process_tx_info(struct ol_txrx_pdev_t *txrx_pdev, void *data) */ txctl_log.priv.frm_hdr = frm_hdr; qdf_assert(txctl_log.priv.txdesc_ctl); + qdf_assert(pl_hdr.size < sizeof(txctl_log.priv.txdesc_ctl)); + pl_hdr.size = (pl_hdr.size > sizeof(txctl_log.priv.txdesc_ctl)) + ? sizeof(txctl_log.priv.txdesc_ctl) : + pl_hdr.size; qdf_mem_copy((void *)&txctl_log.priv.txdesc_ctl, ((void *)data + sizeof(struct ath_pktlog_hdr)), pl_hdr.size); |