commit abe6c43f200a914ccb27cb1550215300610bd651
author Padma, Santhosh Kumar <skpadma@qti.qualcomm.com> Mon Oct 24 18:13:11 2016 +0530
committer Anjaneedevi Kapparapu <akappa@codeaurora.org> Wed Oct 26 16:47:24 2016 +0530
tree 9eb1d0d2738738a359259a7c9530ce796e173a81
parent a2662d20702935aa62dac68bcb65bbe279674e10

prima: Fix oem data response length

OEM_DATA_RSP_SIZE is maximum data response length exchanged
between driver and firmware. Currently OEM_DATA_RSP_SIZE is used
always in copying data from SMD. But firmware may not send
OEM_DATA_RSP_SIZE amount of data. This can result in reading from
unauthorized location and thus can lead to crash. Fix this by getting
appropriate length of oem data response and use that length in copying.

Change-Id: I2011aca892e7702ad1991ec0a4c8f7be15d1dedf
CRs-Fixed: 1081497

CORE/WDI/CP/src/wlan_qct_wdi.c

diff --git a/CORE/WDI/CP/src/wlan_qct_wdi.c b/CORE/WDI/CP/src/wlan_qct_wdi.c
index 46bd758..535237a 100644
--- a/CORE/WDI/CP/src/wlan_qct_wdi.c
+++ b/CORE/WDI/CP/src/wlan_qct_wdi.c
@@ -18779,8 +18779,12 @@
     return WDI_STATUS_E_FAILURE;
   }
 
+  wpalMemoryZero(wdiOemDataRspParams->oemDataRsp, OEM_DATA_RSP_SIZE);
+
   /* Populate WDI structure members */
-  wpalMemoryCopy(wdiOemDataRspParams->oemDataRsp, halStartOemDataRspParams->oemDataRsp, OEM_DATA_RSP_SIZE);
+  wpalMemoryCopy(wdiOemDataRspParams->oemDataRsp,
+                 halStartOemDataRspParams->oemDataRsp,
+                 pEventData->uEventDataSize);
 
   /*Notify UMAC*/
   wdiOemDataRspCb(wdiOemDataRspParams, pWDICtx->pRspCBUserData);