A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-13 08:07:32 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix buffer overflow in hdd_hard_start_xmit

Browse source 
Check STAID value returned by hdd_get_transmit_sta_id against MAX_STA,
before accessing array based on STAID index.

Change-Id: I4ac88e3d95f425ddc3a8690ef5333e0a4e67d328
CRs-Fixed: 1050083
This commit is contained in:
Naveen Rawat 2016-08-03 15:07:23 -07:00 • committed by Gerrit - the friendly Code Review server
commit 209d09342f
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
core/hdd/src/wlan_hdd_tx_rx.c
View file

@ -390,7 +390,7 @@ int hdd_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
STAId = HDD_WLAN_INVALID_STA_ID;
hdd_get_transmit_sta_id(pAdapter, pDestMacAddress, &STAId);
if (STAId == HDD_WLAN_INVALID_STA_ID) {
if (STAId >= WLAN_MAX_STA_COUNT) {
hddLog(LOGE, "Invalid station id, transmit operation suspended");
goto drop_pkt;
}