commit 9aa93749083d856fe30de3e44bfdc38e4b8916b7
author CNSS_WLAN Service <cnssbldsw@qualcomm.com> Tue May 05 05:30:03 2020 -0700
committer Gerrit - the friendly Code Review server <code-review@localhost> Tue May 05 05:30:03 2020 -0700
tree 1d971ce7b56d23c2fcae3961338ae332b830757c
parent de7003393ff9ad347eefe26b7bbdfa66ee1fcbeb
parent 70f73667e0162dc4e47c4aa7c9bea11619708ea4

Merge "wlan: Add sanity check for data in ptt_sock_rx_nlink_msg" into wlan-driver.lnx.1.0

CORE/SVC/src/ptt/wlan_ptt_sock_svc.c

diff --git a/CORE/SVC/src/ptt/wlan_ptt_sock_svc.c b/CORE/SVC/src/ptt/wlan_ptt_sock_svc.c
index dd76232..ef7ec01 100644
--- a/CORE/SVC/src/ptt/wlan_ptt_sock_svc.c
+++ b/CORE/SVC/src/ptt/wlan_ptt_sock_svc.c
@@ -297,6 +297,11 @@
    wnl = (tAniNlHdr *) skb->data;
    radio = wnl->radio;
    type = wnl->nlh.nlmsg_type;
+
+   if (wnl->nlh.nlmsg_len < (sizeof(struct nlmsghdr) +
+       sizeof(int) + sizeof(tAniHdr) + wnl->wmsg.length))
+	   return -EINVAL;
+
    switch (type) {
       case ANI_NL_MSG_PUMAC:  //Message from the PTT socket APP
          PTT_TRACE(VOS_TRACE_LEVEL_INFO, "%s: Received ANI_NL_MSG_PUMAC Msg [0x%X]\n",