A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-12 15:49:17 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix buffer overwrite problem in CCXPLMREQ

Browse source 
This is a qcacld-2.0 to qcacld-3.0 propagation.

Set the number of channels to minimum of input data and
WNI_CFG_VALID_CHANNEL_LIST_LEN.

Change-Id: Ib6fca483ac99cddfcd3b739ce62e86ecd498f1f5
CRs-Fixed: 1001450
This commit is contained in:
Srinivas Girigowda 2016-08-26 14:53:59 -07:00 • committed by qcabuildsw
commit 0fb6cc4dde
1 changed files with 4 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

9
core/hdd/src/wlan_hdd_ioctl.c
View file

@ -1863,8 +1863,9 @@ QDF_STATUS hdd_parse_plm_cmd(uint8_t *pValue, tSirPlmReq *pPlmRequest)
if (content < 0)
return QDF_STATUS_E_FAILURE;
content = QDF_MIN(content, WNI_CFG_VALID_CHANNEL_LIST_LEN);
pPlmRequest->plmNumCh = content;
hdd_debug("numch %d", pPlmRequest->plmNumCh);
hdd_debug("numch: %d", pPlmRequest->plmNumCh);
/* Channel numbers */
for (count = 0; count < pPlmRequest->plmNumCh; count++) {
@ -1883,10 +1884,8 @@ QDF_STATUS hdd_parse_plm_cmd(uint8_t *pValue, tSirPlmReq *pPlmRequest)
return QDF_STATUS_E_FAILURE;
ret = kstrtos32(buf, 10, &content);
if (ret < 0)
return QDF_STATUS_E_FAILURE;
if (content <= 0)
if (ret < 0 || content <= 0 ||
content > WNI_CFG_CURRENT_CHANNEL_STAMAX)
return QDF_STATUS_E_FAILURE;
pPlmRequest->plmChList[count] = content;