diff options
| -rw-r--r-- | qcwcn/wifi_hal/wifilogger_diag.cpp | 17 |
1 files changed, 17 insertions, 0 deletions
diff --git a/qcwcn/wifi_hal/wifilogger_diag.cpp b/qcwcn/wifi_hal/wifilogger_diag.cpp index 5e9227b..d131102 100644 --- a/qcwcn/wifi_hal/wifilogger_diag.cpp +++ b/qcwcn/wifi_hal/wifilogger_diag.cpp @@ -2251,6 +2251,7 @@ wifi_error diag_message_handler(hal_info *info, nl_msg *msg) } } else if (cmd == ANI_NL_MSG_CNSS_DIAG) { uint16_t diag_fw_type; + struct nlmsghdr *nlh = nlmsg_hdr(msg); if (!info->cldctx) { buf = (uint8_t *)NLMSG_DATA(wnl) + sizeof(wnl->clh.radio); @@ -2268,6 +2269,12 @@ wifi_error diag_message_handler(hal_info *info, nl_msg *msg) wnl->nlh.nlmsg_len); return WIFI_ERROR_UNKNOWN; } + } else { + if (nlh->nlmsg_len <= NLMSG_HDRLEN + sizeof(dbglog_slot)) { + ALOGE("Received CNSS_DIAG message with insufficent length: %d: %s:%d", + nlh->nlmsg_len, __FUNCTION__, __LINE__); + return WIFI_ERROR_UNKNOWN; + } } diag_fw_type = event_hdr->diag_type; if (diag_fw_type == DIAG_TYPE_FW_MSG) { @@ -2275,6 +2282,16 @@ wifi_error diag_message_handler(hal_info *info, nl_msg *msg) u16 length = 0; slot = (dbglog_slot *)buf; + if (nlh->nlmsg_len < (NLMSG_HDRLEN + sizeof(dbglog_slot) + + slot->length)) { + ALOGE("Received CNSS_DIAG message with insufficent length: %d:" + " expected: %zu, %s:%d", + nlh->nlmsg_len, + (NLMSG_HDRLEN + sizeof(dbglog_slot) +slot->length), + __FUNCTION__, + __LINE__); + return WIFI_ERROR_UNKNOWN; + } length = get_le32((u8 *)&slot->length); process_fw_diag_msg(info, &slot->payload[0], length); } |