A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-15 01:01:56 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix potential buffer overflow issues in RRM

Browse source 
Check for the maximum supported neighbor response reports while
parsing the pFrm->NeighborReport.

Change-Id: I4ee93adf79057e803bd948ed8657efcd4327efb8
CRs-Fixed: 2098766
This commit is contained in:
Varun Reddy Yeturu 2017-08-30 14:19:10 -07:00 • committed by snandini
commit 151376c3bf
1 changed files with 4 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

4
core/mac/src/pe/rrm/rrm_api.c
View file

@ -354,6 +354,10 @@ rrm_process_neighbor_report_response(tpAniSirGlobal pMac,
pe_err("No neighbor report in the frame...Dropping it");
return eSIR_FAILURE;
}
pe_debug("RRM:received num neighbor reports: %d",
pNeighborRep->num_NeighborReport);
if (pNeighborRep->num_NeighborReport > MAX_SUPPORTED_NEIGHBOR_RPT)
pNeighborRep->num_NeighborReport = MAX_SUPPORTED_NEIGHBOR_RPT;
length = (sizeof(tSirNeighborReportInd)) +
(sizeof(tSirNeighborBssDescription) *
(pNeighborRep->num_NeighborReport - 1));