A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-24 13:44:26 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: Fix Access Array out of bound

Browse source 
Upper bound length check is performed for index
that is used to access the array elements.

Change-Id: Id39ef1bd0446ce71be4f74532f2a7650df1a5432
CRs-Fixed: 2218940
This commit is contained in:
Radhika Sriram 2018-04-04 19:04:49 +05:30 • committed by Gerrit - the friendly Code Review server
commit 00392f394c
1 changed files with 10 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

10
umac/cmn_services/crypto/src/wlan_crypto_global_api.c
View file

@ -550,6 +550,11 @@ QDF_STATUS wlan_crypto_setkey(struct wlan_objmgr_vdev *vdev,
uint16_t kid = req_key->keyix;
if (kid == WLAN_CRYPTO_KEYIX_NONE)
kid = 0;
if (kid >= WLAN_CRYPTO_MAXKEYIDX) {
qdf_print("%s[%d] invalid keyid %d \n",
__func__, __LINE__, kid);
return QDF_STATUS_E_INVAL;
}
if (!crypto_priv->key[kid]) {
crypto_priv->key[kid]
= qdf_mem_malloc(
@ -826,6 +831,11 @@ QDF_STATUS wlan_crypto_delkey(struct wlan_objmgr_vdev *vdev,
if (key_idx >= WLAN_CRYPTO_MAXKEYIDX) {
uint8_t igtk_idx = key_idx - WLAN_CRYPTO_MAXKEYIDX;
if (igtk_idx >= WLAN_CRYPTO_MAXIGTKKEYIDX) {
qdf_print("%s[%d] Igtk key invalid keyid %d\n",
__func__, __LINE__, igtk_idx);
return QDF_STATUS_E_INVAL;
}
key = crypto_priv->igtk_key[igtk_idx];
crypto_priv->igtk_key[igtk_idx] = NULL;
if (key)