From 137abd72ab9c031c687d869e2634a018e935e666 Mon Sep 17 00:00:00 2001 From: Wu Gao Date: Thu, 26 Nov 2020 20:17:09 +0800 Subject: [PATCH] qcacmn: Fix memory access out of bounds when sort 6g channel list In arch 32 platform, the size of rnr_chan_info is 8 bytes, and it only allocates 4 bytes for each of them. Which cause memory access out of bounds. Change-Id: I4f1798c5354c6a76e32bdfed13ade9667465b789 CRs-Fixed: 2827289 --- umac/scan/core/src/wlan_scan_manager_6ghz.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/umac/scan/core/src/wlan_scan_manager_6ghz.c b/umac/scan/core/src/wlan_scan_manager_6ghz.c index d3a45823c6c3..c0181c1ea9a3 100644 --- a/umac/scan/core/src/wlan_scan_manager_6ghz.c +++ b/umac/scan/core/src/wlan_scan_manager_6ghz.c @@ -75,7 +75,7 @@ scm_sort_6ghz_channel_list(struct wlan_objmgr_vdev *vdev, if (tmp_list_count <= 1) return; - rnr_chan_info = qdf_mem_malloc(sizeof(rnr_chan_info) * tmp_list_count); + rnr_chan_info = qdf_mem_malloc(sizeof(*rnr_chan_info) * tmp_list_count); if (!rnr_chan_info) return;