From 209d09342f17036f9f239d4dea3ea0430860da73 Mon Sep 17 00:00:00 2001
From: Naveen Rawat <naveenrawat@codeaurora.org>
Date: Wed, 3 Aug 2016 15:07:23 -0700
Subject: [PATCH] qcacld-3.0: Fix buffer overflow in hdd_hard_start_xmit

Check STAID value returned by hdd_get_transmit_sta_id against MAX_STA,
before accessing array based on STAID index.

Change-Id: I4ac88e3d95f425ddc3a8690ef5333e0a4e67d328
CRs-Fixed: 1050083
---
 core/hdd/src/wlan_hdd_tx_rx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/hdd/src/wlan_hdd_tx_rx.c b/core/hdd/src/wlan_hdd_tx_rx.c
index 1385d3d340ca..03d259a21a3e 100644
--- a/core/hdd/src/wlan_hdd_tx_rx.c
+++ b/core/hdd/src/wlan_hdd_tx_rx.c
@@ -390,7 +390,7 @@ int hdd_hard_start_xmit(struct sk_buff *skb, struct net_device *dev)
 	STAId = HDD_WLAN_INVALID_STA_ID;
 
 	hdd_get_transmit_sta_id(pAdapter, pDestMacAddress, &STAId);
-	if (STAId == HDD_WLAN_INVALID_STA_ID) {
+	if (STAId >= WLAN_MAX_STA_COUNT) {
 		hddLog(LOGE, "Invalid station id, transmit operation suspended");
 		goto drop_pkt;
 	}