From 62e33cb8bb39e57973856678368c7e84135e0b87 Mon Sep 17 00:00:00 2001 From: Gururaj Patil Date: Thu, 24 Oct 2019 12:05:59 +0000 Subject: [PATCH] wlan: Avoid int overflow in csr_scan_save_preferred_network_found() Add validation check on frameLength to avoid int overflow in csr_scan_save_preferred_network_found function. Change-Id: I6bcdfb757610152bc801d5134e62dd58629d1e81 CRs-Fixed: 2232358 Signed-off-by: Gururaj Patil --- drivers/staging/prima/CORE/SME/src/csr/csrApiScan.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/drivers/staging/prima/CORE/SME/src/csr/csrApiScan.c b/drivers/staging/prima/CORE/SME/src/csr/csrApiScan.c index d24c4d13ffe..951197f2194 100644 --- a/drivers/staging/prima/CORE/SME/src/csr/csrApiScan.c +++ b/drivers/staging/prima/CORE/SME/src/csr/csrApiScan.c @@ -8435,6 +8435,13 @@ eHalStatus csrScanSavePreferredNetworkFound(tpAniSirGlobal pMac, uLen = pPrefNetworkFoundInd->frameLength - (SIR_MAC_HDR_LEN_3A + SIR_MAC_B_PR_SSID_OFFSET); } + if (uLen > (UINT_MAX - sizeof(tCsrScanResult))) { + smsLog(pMac, LOGE, + FL("Incorrect len: %d, may leads to int overflow, uLen %d"), + pPrefNetworkFoundInd->frameLength, uLen); + vos_mem_vfree(pParsedFrame); + return eHAL_STATUS_FAILURE; + } if (uLen > (UINT_MAX - sizeof(tCsrScanResult))) { smsLog(pMac, LOGE, FL("Incorrect len: %d, may leads to int overflow, uLen %d"),