fda1af6bef
In the function wma_passpoint_match_event_handler, fixed param event data from firmware is filled in the destination buffer and indication is sent to upper layers. The buffer allocation is done for the size (wmi_passpoint_event_hdr*) + event->ie_length + event->anqp_length. The maximum firmware event message size is WMI_SVC_MSG_MAX_SIZE. If either, ie_length and anqp_length combined is greater than WMI_SVC_MSG_MAX_SIZE or either of the two exceeds WMI_SVC_MSG_MAC_SIZE, an OOB write will occur in wma_passpoint_match_event_handler. Add check to ensure either of the values ie_length or anqp_lenth or (ie_length + anqp_length) doesnt exceed the WMI_SVC_MAX_SIZE. Return failure if it exceeds. Change-Id: I21f473ca0b99ebb8488f2cca3c0774817ea97c3a CRs-Fixed: 2201190 |
||
|---|---|---|
| .. | ||
| inc | ||
| src | ||