qcacld-3.0: Add check for if_id in wma_tbttoffset_update_event_handler
Currently if_id used in the for loop is incremented based on vdev_map != 0
and vdev_map is a uint_32, received from FW, and is right shifted by one bit
for each iteration. This could result in if_id going upto max of 31 and cause
OOB read.
Add sanity check to make sure if_id is less than max_bssid.
Change-Id: I7e0c4e9a26cb67f41e35c60c2756d7ad02cf43ea
CRs-Fixed: 2119443
diff --git a/core/wma/src/wma_mgmt.c b/core/wma/src/wma_mgmt.c
index a978520..8e33bb7 100644
--- a/core/wma/src/wma_mgmt.c
+++ b/core/wma/src/wma_mgmt.c
@@ -2531,7 +2531,7 @@
return -EINVAL;
}
- for (; (vdev_map); vdev_map >>= 1, if_id++) {
+ for (; (if_id < wma->max_bssid && vdev_map); vdev_map >>= 1, if_id++) {
if (!(vdev_map & 0x1) || (!(intf[if_id].handle)))
continue;