diff options
| author | TreeHugger Robot <treehugger-gerrit@google.com> | 2021-05-15 13:44:31 +0000 |
|---|---|---|
| committer | Android (Google) Code Review <android-gerrit@google.com> | 2021-05-15 13:44:31 +0000 |
| commit | d3d0a6c0adb9e9ba466132c6961824318e437b8c (patch) | |
| tree | 426277bb609c35e29a7fdf0df051d7f178ea7682 | |
| parent | e49f3db2b2ccffd88c9107277b73a9b60e44ab03 (diff) | |
| parent | 87ab975fff35de9de4dcd1bc494896065b1fcc47 (diff) | |
| download | wlan-d3d0a6c0adb9e9ba466132c6961824318e437b8c.tar.gz | |
Merge "llstats: Add negative length check befor memcpy" into sc-dev
| -rw-r--r-- | qcwcn/wifi_hal/llstats.cpp | 17 |
1 files changed, 13 insertions, 4 deletions
diff --git a/qcwcn/wifi_hal/llstats.cpp b/qcwcn/wifi_hal/llstats.cpp index 407a6c3..50b8149 100644 --- a/qcwcn/wifi_hal/llstats.cpp +++ b/qcwcn/wifi_hal/llstats.cpp @@ -1151,10 +1151,19 @@ int LLStatsCommand::handleResponse(WifiEvent &reply) memset(pIfaceStat, 0, resultsBufSize); if(mResultsParams.iface_stat) { - memcpy ( pIfaceStat, mResultsParams.iface_stat, - sizeof(wifi_iface_stat)); - free (mResultsParams.iface_stat); - mResultsParams.iface_stat = pIfaceStat; + if(resultsBufSize >= sizeof(wifi_iface_stat)) { + memcpy ( pIfaceStat, mResultsParams.iface_stat, + sizeof(wifi_iface_stat)); + free (mResultsParams.iface_stat); + mResultsParams.iface_stat = pIfaceStat; + } else { + ALOGE("%s: numPeers = %u, num_rates= %u, " + "either numPeers or num_rates is invalid", + __FUNCTION__,numPeers,num_rates); + status = WIFI_ERROR_UNKNOWN; + free(pIfaceStat); + goto cleanup; + } } wifi_peer_info *pPeerStats; pIfaceStat->num_peers = numPeers; |