From 0105770430bd7508ff85448aed0fdd199fdf04e0 Mon Sep 17 00:00:00 2001 From: Tushnim Bhattacharyya Date: Wed, 26 Oct 2016 15:14:35 -0700 Subject: [PATCH] qcacld-3.0: Fix buffer overflow issue in cds_update_with_safe_channel_list Fix the size of pcl_channels & pcl_weight array to be QDF_MAX_NUM_CHAN in cds_get_nondfs_preferred_channel. Also make sure all the callers of cds_get_channel_list uses QDF_MAX_NUM_CHAN as channel array size. Change-Id: I256421f54180d1d8f9f6abd549d417e74d62add5 CRs-Fixed: 1082596 --- core/cds/src/cds_concurrency.c | 4 ++-- core/sap/inc/sap_api.h | 2 +- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/core/cds/src/cds_concurrency.c b/core/cds/src/cds_concurrency.c index b297c09f5873..56904b87cd9f 100644 --- a/core/cds/src/cds_concurrency.c +++ b/core/cds/src/cds_concurrency.c @@ -8353,8 +8353,8 @@ uint8_t cds_get_nondfs_preferred_channel(enum cds_con_mode mode, bool for_existing_conn) { - uint8_t pcl_channels[NUM_CHANNELS]; - uint8_t pcl_weight[NUM_CHANNELS]; + uint8_t pcl_channels[QDF_MAX_NUM_CHAN]; + uint8_t pcl_weight[QDF_MAX_NUM_CHAN]; /* * in worst case if we can't find any channel at all diff --git a/core/sap/inc/sap_api.h b/core/sap/inc/sap_api.h index 7e251d3c6264..2f73ae9b89a8 100644 --- a/core/sap/inc/sap_api.h +++ b/core/sap/inc/sap_api.h @@ -485,7 +485,7 @@ struct sap_acs_cfg { #endif uint16_t ch_width; - uint8_t pcl_channels[NUM_CHANNELS]; + uint8_t pcl_channels[QDF_MAX_NUM_CHAN]; uint32_t pcl_ch_count; /* ACS Algo Output */ uint8_t pri_ch;