commit c6bef88b9dc090a7af74c64a513179e8a98a4e25
author Kiet Lam <c_kietl@qca.qualcomm.com> Mon Nov 11 17:07:36 2013 +0530
committer Kiet Lam <c_kietl@qca.qualcomm.com> Sat Nov 16 16:51:20 2013 -0800
tree 1c591ebe6e230c8e91988aaaccdf066419de49f9
parent 1f98cbd6416dfdbd16174da75cd49dfe0009d9b3

wlan: adding check for ts_info.up.

'params' is user controlled, and 'ts_info.up' could be defined to be
greater than maximum sme_QosWmmUpType enum, resulting in hddWmmUpToAcMap
being indexed out of bounds.
Validated 0 < ts_info.up < SME_QOS_WMM_UP_MAX.

Change-Id: Ia1966db2a6c8ce8d3a9422f0dd9d91a59573c783
CRs-Fixed: 567234

CORE/HDD/src/wlan_hdd_wext.c

diff --git a/CORE/HDD/src/wlan_hdd_wext.c b/CORE/HDD/src/wlan_hdd_wext.c
index 92107d9..a6fe45f 100644
--- a/CORE/HDD/src/wlan_hdd_wext.c
+++ b/CORE/HDD/src/wlan_hdd_wext.c
@@ -5104,6 +5104,11 @@
       return 0;
    }
    tSpec.ts_info.up = params[HDD_WLAN_WMM_PARAM_USER_PRIORITY];
+   if(0 > tSpec.ts_info.up || SME_QOS_WMM_UP_MAX < tSpec.ts_info.up)
+   {
+   hddLog(VOS_TRACE_LEVEL_ERROR,"***ts_info.up out of bounds***");
+   return 0;
+   }
 
    VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH,
              "%s:TS_INFO PSB %d UP %d !!!", __func__,