[PATCH wireless-next v2 2/2] wifi: mwifiex: validate GET_HW_SPEC TLV lengths before parsing

[jeff.chen_1@oss.nxp.com]

From: Jeff Chen <jeff.chen_1@nxp.com>

Validate TLV lengths before accessing TLV payloads in
mwifiex_ret_get_hw_spec().

Signed-off-by: Jeff Chen <jeff.chen_1@nxp.com>
---
 drivers/net/wireless/marvell/mwifiex/cmdevt.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/drivers/net/wireless/marvell/mwifiex/cmdevt.c b/drivers/net/wireless/marvell/mwifiex/cmdevt.c
index 268a795db486..6e04d7da6217 100644
--- a/drivers/net/wireless/marvell/mwifiex/cmdevt.c
+++ b/drivers/net/wireless/marvell/mwifiex/cmdevt.c
@@ -1494,6 +1494,7 @@ int mwifiex_ret_get_hw_spec(struct mwifiex_private *priv,
 	struct hw_spec_max_conn *max_conn;
 	u16 resp_size, api_id;
 	int i, left_len, parsed_len = 0;
+	int tlv_len;
 
 	adapter->fw_cap_info = le32_to_cpu(hw_spec->fw_cap_info);
 
@@ -1559,8 +1560,16 @@ int mwifiex_ret_get_hw_spec(struct mwifiex_private *priv,
 		left_len = resp_size - sizeof(struct host_cmd_ds_get_hw_spec);
 		while (left_len > sizeof(struct mwifiex_ie_types_header)) {
 			tlv = (void *)&hw_spec->tlvs + parsed_len;
+			tlv_len = sizeof(*tlv) + le16_to_cpu(tlv->len);
+
+			if (tlv_len > left_len)
+				break;
+
 			switch (le16_to_cpu(tlv->type)) {
 			case TLV_TYPE_API_REV:
+				if (tlv_len < sizeof(struct hw_spec_api_rev))
+					break;
+
 				api_rev = (struct hw_spec_api_rev *)tlv;
 				api_id = le16_to_cpu(api_rev->api_id);
 				switch (api_id) {
@@ -1613,6 +1622,9 @@ int mwifiex_ret_get_hw_spec(struct mwifiex_private *priv,
 				}
 				break;
 			case TLV_TYPE_MAX_CONN:
+				if (tlv_len < sizeof(struct hw_spec_max_conn))
+					break;
+
 				max_conn = (struct hw_spec_max_conn *)tlv;
 				adapter->max_p2p_conn = max_conn->max_p2p_conn;
 				adapter->max_sta_conn = max_conn->max_sta_conn;
-- 
2.34.1