A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-24 13:44:26 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: Fix memory copy overflow in dp_process_htt_stat_msg

Browse source 
In dp_process_htt_stat_msg function, the stats message must be
interpreted one by one. It can't move to the next message unless
the current one is handled completedly. Or else it will cause a
memory copy overflow.

CRs-Fixed: 2156792
Change-Id: I8a3784cd17f2a68b16c4f47c6b1a24e12d23aaa5
This commit is contained in:
chenguo 2017-12-14 21:56:46 +08:00 • committed by snandini
commit 2649554e73
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
dp/wifi3.0/dp_htt.c
View file

@ -1404,7 +1404,8 @@ static inline void dp_process_htt_stat_msg(struct htt_stats_context *htt_stats,
goto error;
}
tlv_remain_len += HTT_TLV_HDR_LEN;
if (!tlv_buf_head)
tlv_remain_len += HTT_TLV_HDR_LEN;
if ((tlv_remain_len <= msg_remain_len)) {
/* Case 3 */
@ -1454,7 +1455,6 @@ static inline void dp_process_htt_stat_msg(struct htt_stats_context *htt_stats,
msg_remain_len);
tlv_remain_len -= msg_remain_len;
tlv_buf_tail += msg_remain_len;
msg_remain_len = 0;
}
}