From 0ac62e88ee5587a08cb9b98e52a346e7dc530859 Mon Sep 17 00:00:00 2001 From: Sreelakshmi Konamki Date: Mon, 24 Jul 2017 18:53:48 +0530 Subject: [PATCH] qcacld-3.0: Validate 'num_RICDataDesc' to avoid error logs qcacld-2.0 to qcacld-3.0 propagation In sir_convert_assoc_resp_frame2_struct(), 'pAssocRsp->ricPresent' is set to true when 'num_RICDataDesc' is 0, this causes qdf_mem_malloc() to be called with invalid length 0. Add change to validate 'num_RICDataDesc' to avoid above issue. Change-Id: If5e59477efa4df01ca216904645babf769b55c47 CRs-Fixed: 2078891 --- core/mac/src/sys/legacy/src/utils/src/parser_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/mac/src/sys/legacy/src/utils/src/parser_api.c b/core/mac/src/sys/legacy/src/utils/src/parser_api.c index 621fade67905..46e9318fa880 100644 --- a/core/mac/src/sys/legacy/src/utils/src/parser_api.c +++ b/core/mac/src/sys/legacy/src/utils/src/parser_api.c @@ -2874,7 +2874,7 @@ sir_convert_assoc_resp_frame2_struct(tpAniSirGlobal pMac, sizeof(tDot11fIEFTInfo)); } - if (ar.num_RICDataDesc <= 2) { + if (ar.num_RICDataDesc && ar.num_RICDataDesc <= 2) { for (cnt = 0; cnt < ar.num_RICDataDesc; cnt++) { if (ar.RICDataDesc[cnt].present) { qdf_mem_copy(&pAssocRsp->RICData[cnt],