wlan: Add max index check for dscp_to_up_map array
qcacld-3.0 to prima propagation.
In SME layer, boundary check for dscp_to_up_map array is not present.
The dscpmapping is an array of 0x40 elements. Values in dscp_exceptions
are used to index dscpmapping. The indices are not validated to be less
than 0x40. The dscp_exceptions array is received from association
response frame. A malicious AP can send values up to 0xff, causing OOB
write of dscpmapping array.
Hence, max index check is added to avoid OOB write of dscpmapping array.
Change-Id: I73526849677e867673fc0bd0024ed2b003e4f89e
CRs-Fixed: 2585141
diff --git a/CORE/HDD/inc/wlan_hdd_main.h b/CORE/HDD/inc/wlan_hdd_main.h
index 6ee9a85..5738d63 100644
--- a/CORE/HDD/inc/wlan_hdd_main.h
+++ b/CORE/HDD/inc/wlan_hdd_main.h
@@ -1369,7 +1369,7 @@
v_BOOL_t isLinkLayerStatsSet;
#endif
/* DSCP to UP QoS Mapping */
- sme_QosWmmUpType hddWmmDscpToUpMap[WLAN_HDD_MAX_DSCP+1];
+ sme_QosWmmUpType hddWmmDscpToUpMap[WLAN_MAX_DSCP+1];
/* Lock for active sessions while processing deauth/Disassoc */
spinlock_t lock_for_active_session;
tSirFwStatsResult fwStatsRsp;