qcacmn: Check number of NOA descriptors
There is possible to read buffer overflow. Since it don't check number
of NOA descriptor when handling WMI_P2P_NOA_EVENTID.
Change-Id: I08fc3ac429bc19a8df7ac429fbe779fa3b227318
CRs-Fixed: 2307321
diff --git a/wmi_unified_tlv.c b/wmi_unified_tlv.c
index a25a69b..9719965 100644
--- a/wmi_unified_tlv.c
+++ b/wmi_unified_tlv.c
@@ -18527,6 +18527,11 @@
(uint8_t) WMI_UNIFIED_NOA_ATTR_CTWIN_GET(wmi_noa_info);
descriptors = WMI_UNIFIED_NOA_ATTR_NUM_DESC_GET(wmi_noa_info);
param->num_desc = (uint8_t) descriptors;
+ if (param->num_desc > WMI_P2P_MAX_NOA_DESCRIPTORS) {
+ WMI_LOGE("%s: invalid num desc:%d", __func__,
+ param->num_desc);
+ return QDF_STATUS_E_INVAL;
+ }
WMI_LOGD("%s:index %u, opps_ps %u, ct_window %u, num_descriptors = %u", __func__,
param->index, param->opps_ps, param->ct_window,