From 18b4936767f8808d104cdd40fd2a3f04b07221cf Mon Sep 17 00:00:00 2001 From: gaurank kathpalia Date: Sun, 15 Apr 2018 23:12:03 +0530 Subject: [PATCH] qcacld-3.0: Fix out of bound write in mcs_set The driver fills the mcs set array in hdd_update_tgt_ht_cap for all rf chains and does not have a upper boundary check to cfg->num_rf_chains, which could lead to out of bound write a valid value to a memory which not allocated to mcs set Fix is to have a check to cfg->num_rf_chains Change-Id: Ibeb5e783e2369ebee1bbf3fc724d06736c174c69 CRs-Fixed: 2221902 --- core/hdd/src/wlan_hdd_main.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/core/hdd/src/wlan_hdd_main.c b/core/hdd/src/wlan_hdd_main.c index dc5a9298bf22..e9fb021ffbe9 100644 --- a/core/hdd/src/wlan_hdd_main.c +++ b/core/hdd/src/wlan_hdd_main.c @@ -1417,7 +1417,8 @@ static void hdd_update_tgt_ht_cap(struct hdd_context *hdd_ctx, if (sme_cfg_get_str(hdd_ctx->hHal, WNI_CFG_SUPPORTED_MCS_SET, mcs_set, &value) == QDF_STATUS_SUCCESS) { hdd_debug("Read MCS rate set"); - + if (cfg->num_rf_chains > SIZE_OF_SUPPORTED_MCS_SET) + cfg->num_rf_chains = SIZE_OF_SUPPORTED_MCS_SET; if (pconfig->enable2x2) { for (value = 0; value < cfg->num_rf_chains; value++) mcs_set[value] =