tree 5d57085e8eb43fe3bf7c8d8502263319d28e26d0
parent 70aeda1cdd3e8fa6e2520f81310a047a4de1d3db
author Pragaspathi Thilagaraj <tpragasp@codeaurora.org> 1557850175 +0530
committer nshrivas <nshrivas@codeaurora.org> 1558035799 -0700

qcacmn: Fix possible OOB in target_if_direct_buf_rx_rsp_event_handler

The function target_if_direct_buf_rx_rsp_event_handler() handles
the WMI_PDEV_DMA_RING_BUF_RELEASE_EVENTID event from target.
This function calls extract_dbr_buf_release_fixed_tlv() to copy
the module id, pdev id number of buffer release entry and number
of meta data release entries. The value of module id is used to
index the array dbr_mod_param to get the value of mod_param.
So if the module id value greater than dbr_pdev_obj->num_modules
could result in possible OOB.

Validate mod_id received in the fixed param of the event
WMI_PDEV_DMA_RING_BUF_RELEASE_EVENTID against
dbr_pdev_obj->num_modules.

Change-Id: I1c2c0a2a9c98d8b787496aba7a7c4f8fd781de16
CRs-Fixed: 2428798