drivers: staging: qcacld: Merge branch android-msm-sunfish-4.14-andro…

…id12-qpr1 (android-12.0.0_r0.33) sync: e30fcb9 qcacld-3.0: Merge branch 'android-msm-pixel-4.14-sc-security' into android-msm-pixel-4.14-sc-qpr1 sync: 2b33b7b fw-api: Merge android-msm-floral-4.14-rvc-qpr1 into android-msm-pixel-4.14 sync: f768261 qcacmn: Replace WMI_LOGI() with wmi_* appropriate log level Signed-off-by: engstk <[email protected]>
engstk · Jan 5, 2022 · bc7fbc6 · bc7fbc6
1 parent ee5d6eb
commit bc7fbc6
Showing 1 changed file with 15 additions and 1 deletion.
diff --git a/drivers/staging/qcacld-3.0/core/wma/src/wma_mgmt.c b/drivers/staging/qcacld-3.0/core/wma/src/wma_mgmt.c
@@ -2655,8 +2655,22 @@ static QDF_STATUS wma_unified_bcn_tmpl_send(tp_wma_handle wma,
 		tmpl_len = *(uint32_t *) &bcn_info->beacon[0];
 	else
 		tmpl_len = bcn_info->beaconLength;
-	if (p2p_ie_len)
+
+	if (tmpl_len > WMI_BEACON_TX_BUFFER_SIZE) {
+		wma_err("tmpl_len: %d > %d. Invalid tmpl len", tmpl_len,
+			WMI_BEACON_TX_BUFFER_SIZE);
+		return -EINVAL;
+	}
+
+	if (p2p_ie_len) {
+		if (tmpl_len <= p2p_ie_len) {
+			wma_err("tmpl_len %d <= p2p_ie_len %d, Invalid",
+				tmpl_len, p2p_ie_len);
+			return -EINVAL;
+		}
 		tmpl_len -= (uint32_t) p2p_ie_len;
+	}
+
 	frm = bcn_info->beacon + bytes_to_strip;
 	tmpl_len_aligned = roundup(tmpl_len, sizeof(A_UINT32));
 	/*