qcacld-3.0: Add sanity check for total_peer_len in wma_get_ll_stats_ext_buf
Add additional sanity checks for total_peer_len in wma_get_ll_stats_ext_buf.
Missing changes for CLD3.2 from I2689873c2c5e63c83e5059563662c0c69dc659fc
Change-Id: I6f82c9ef251e0290f9cf68e9fcd2d8868a5a302c
CRs-Fixed: 2121194
diff --git a/core/wma/src/wma_utils.c b/core/wma/src/wma_utils.c
index e10193a..eb59603 100644
--- a/core/wma/src/wma_utils.c
+++ b/core/wma/src/wma_utils.c
@@ -767,9 +767,12 @@
(sizeof(struct sir_wifi_tx) +
sizeof(struct sir_wifi_rx)));
}
- if (peer_num > (WMI_SVC_MSG_MAX_SIZE /
- (sizeof(struct sir_wifi_ll_ext_peer_stats) +
- total_peer_len))) {
+ if (total_peer_len > WMI_SVC_MSG_MAX_SIZE) {
+ excess_data = true;
+ break;
+ }
+ if (peer_num > (WMI_SVC_MSG_MAX_SIZE - total_peer_len) /
+ sizeof(struct sir_wifi_ll_ext_peer_stats)) {
excess_data = true;
break;
} else {