From 2649554e7323b654ac481d3d4d9f8062880c29fd Mon Sep 17 00:00:00 2001 From: chenguo Date: Thu, 14 Dec 2017 21:56:46 +0800 Subject: [PATCH] qcacmn: Fix memory copy overflow in dp_process_htt_stat_msg In dp_process_htt_stat_msg function, the stats message must be interpreted one by one. It can't move to the next message unless the current one is handled completedly. Or else it will cause a memory copy overflow. CRs-Fixed: 2156792 Change-Id: I8a3784cd17f2a68b16c4f47c6b1a24e12d23aaa5 --- dp/wifi3.0/dp_htt.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/dp/wifi3.0/dp_htt.c b/dp/wifi3.0/dp_htt.c index 500a0fb339b2..a37b3e2c7218 100644 --- a/dp/wifi3.0/dp_htt.c +++ b/dp/wifi3.0/dp_htt.c @@ -1404,7 +1404,8 @@ static inline void dp_process_htt_stat_msg(struct htt_stats_context *htt_stats, goto error; } - tlv_remain_len += HTT_TLV_HDR_LEN; + if (!tlv_buf_head) + tlv_remain_len += HTT_TLV_HDR_LEN; if ((tlv_remain_len <= msg_remain_len)) { /* Case 3 */ @@ -1454,7 +1455,6 @@ static inline void dp_process_htt_stat_msg(struct htt_stats_context *htt_stats, msg_remain_len); tlv_remain_len -= msg_remain_len; tlv_buf_tail += msg_remain_len; - msg_remain_len = 0; } }