commit d82cb7d629b24367685a34f15e9b95e802537c0e
author Mukul Sharma <mukul@qti.qualcomm.com> Thu Jul 03 14:53:30 2014 +0530
committer Kiet Lam <c_kietl@qca.qualcomm.com> Tue Jul 15 08:43:53 2014 -0700
tree 8aa59a5adb7f396f693d56b02216dd82db9dc2fb
parent 04c2ae7d8c06b37792a1e2991619997e070dbff4

wlan: Fix static analysis issue(Buffer Overflow) in HDD

Fix Buffer Overflow Array Index Out of Boundsfound in static
analysis in HDD.In hdd_wmm_select_queue/hdd_hostapd_select_queue
skb->priority is assigned as enum which can have value 0 to 8,
we use global array hddLinuxUpToAcMap for up to ac mapping purpose,
which can take maximum index range from 0 to 7.As up (enum)
might be assgined up to 0-8(8 is SME_QOS_WMM_UP_MAX), so
we should check up before going for mapping to ac.

Change-Id: Ia2855cd0989fef44c55aa2b7af73f95ad0c5954a
CRs-Fixed: 689045

CORE/HDD/src/wlan_hdd_wmm.c

diff --git a/CORE/HDD/src/wlan_hdd_wmm.c b/CORE/HDD/src/wlan_hdd_wmm.c
index b75745e..3174492 100644
--- a/CORE/HDD/src/wlan_hdd_wmm.c
+++ b/CORE/HDD/src/wlan_hdd_wmm.c
@@ -1892,7 +1892,14 @@
     spin_unlock_bh( &pAdapter->staInfo_lock );
 done:
    skb->priority = up;
-   queueIndex = hddLinuxUpToAcMap[skb->priority];
+   if(skb->priority < SME_QOS_WMM_UP_MAX)
+         queueIndex = hddLinuxUpToAcMap[skb->priority];
+   else
+   {
+       VOS_TRACE(VOS_MODULE_ID_HDD, WMM_TRACE_LEVEL_INFO,
+                 "%s: up=%d is going beyond max value", __func__, up);
+      queueIndex = hddLinuxUpToAcMap[SME_QOS_WMM_UP_BE];
+   }
 
    return queueIndex;
 }
@@ -1960,7 +1967,14 @@
    }
 done:
    skb->priority = up;
-   queueIndex = hddLinuxUpToAcMap[skb->priority];
+   if(skb->priority < SME_QOS_WMM_UP_MAX)
+         queueIndex = hddLinuxUpToAcMap[skb->priority];
+   else
+   {
+       VOS_TRACE(VOS_MODULE_ID_HDD, WMM_TRACE_LEVEL_INFO,
+                 "%s: up=%d is going beyond max value", __func__, up);
+      queueIndex = hddLinuxUpToAcMap[SME_QOS_WMM_UP_BE];
+   }
 
    return queueIndex;
 }