qcacld-3.0: Add bound check for numap to avoid integer overflow
Currently, numap is int and is assigned with a uint32 value from
fw which might lead to integer overflow. Also, when multiplying
the uint32 value with sizeof dest_ap could lead to int overflow
if the value of numap is close to uint32's maximum limit.
Fix/Modify numap to uint32 to be in sync with value from fw cmd.
Also add check to trim down numap value to max (10) if value is
greater than max (10).
Change-Id: I060f585c8c951807cd32b5eec75c1bad2e84a75b
CRs-Fixed: 2082665
diff --git a/core/wma/src/wma_scan_roam.c b/core/wma/src/wma_scan_roam.c
index 24b72d3..f496a93 100644
--- a/core/wma/src/wma_scan_roam.c
+++ b/core/wma/src/wma_scan_roam.c
@@ -103,6 +103,12 @@
};
#define WMA_EXTSCAN_CYCLE_WAKE_LOCK_DURATION (5 * 1000) /* in msec */
+
+/*
+ * Maximum number of entires that could be present in the
+ * WMI_EXTSCAN_HOTLIST_MATCH_EVENT buffer from the firmware
+ */
+#define WMA_EXTSCAN_MAX_HOTLIST_ENTRIES 10
#endif
/**
@@ -3733,7 +3739,8 @@
struct extscan_hotlist_match *dest_hotlist;
tSirWifiScanResult *dest_ap;
wmi_extscan_wlan_descriptor *src_hotlist;
- int numap, j, ap_found = 0;
+ uint32_t numap;
+ int j, ap_found = 0;
tpAniSirGlobal pMac = cds_get_context(QDF_MODULE_ID_PE);
if (!pMac) {
@@ -3758,6 +3765,11 @@
WMA_LOGE("%s: Hotlist AP's list invalid", __func__);
return -EINVAL;
}
+ if (numap > WMA_EXTSCAN_MAX_HOTLIST_ENTRIES) {
+ WMA_LOGE("%s: Total Entries %u greater than max",
+ __func__, numap);
+ numap = WMA_EXTSCAN_MAX_HOTLIST_ENTRIES;
+ }
dest_hotlist = qdf_mem_malloc(sizeof(*dest_hotlist) +
sizeof(*dest_ap) * numap);
if (!dest_hotlist) {