From 28556aa279c8bacff08097beb6c70091f4b745d6 Mon Sep 17 00:00:00 2001 From: Sushant Kaushik Date: Wed, 22 Jul 2015 12:22:20 +0530 Subject: [PATCH] qcacld-3.0: Fix static analysis error in limProcessTdls.c qcacld-2.0 to qcacld-3.0 propagation Currently while populating 11a and 11b rates, there is no bound check for rateset array. This can result in buffer overflow. As a part of fix add bound check to avoid any buffer overflow for the rateset. CRs-fixed: 798054 Change-Id: Ib42f5de642ad54d5c2a1ccdab37d88928b98af01 --- core/mac/src/pe/lim/lim_process_tdls.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/core/mac/src/pe/lim/lim_process_tdls.c b/core/mac/src/pe/lim/lim_process_tdls.c index 9686b4b7e318..0b49077eea2c 100644 --- a/core/mac/src/pe/lim/lim_process_tdls.c +++ b/core/mac/src/pe/lim/lim_process_tdls.c @@ -2159,15 +2159,13 @@ lim_tdls_populate_matching_rate_set(tpAniSirGlobal mac_ctx, tpDphHashNode stads, (temp_rate_set.rate[j] & 0x7F)) continue; -#ifdef FEATURE_WLAN_NON_INTEGRATED_SOC - if ((b_rateindex > HAL_NUM_11B_RATES) || - (a_rateindex > HAL_NUM_11A_RATES)) { + if ((b_rateindex > SIR_NUM_11B_RATES) || + (a_rateindex > SIR_NUM_11A_RATES)) { lim_log(mac_ctx, LOGE, FL("Invalid number of rates (11b->%d, 11a->%d)"), b_rateindex, a_rateindex); return eSIR_FAILURE; } -#endif if (sirIsArate(temp_rate_set2.rate[i] & 0x7f)) { is_a_rate = 1; if (a_rateindex < SIR_NUM_11A_RATES)