From 2f5e3dd670c33628236d1cb2df8ceff7d961eeb7 Mon Sep 17 00:00:00 2001 From: Krunal Soni Date: Wed, 3 Oct 2018 11:48:27 -0700 Subject: [PATCH] qcacld-3.0: Exclude length field size from max beacon payload size Don't account length field size while comparing against max beacon size. Current driver starts from (ptr+4 bytes) then tries to copy 512 bytes from that point which creates to copy extra 4 bytes beyond the array's boundary. Instead copy only 508 bytes if driver starts copying from (ptr+ 4bytes). ptr ^ | | +---------------+--------------------------------+ | | | | Length | Max Beacon payload | | | | +---------------+--------------------------------+ |<-- 4 bytes -->|<-------- 508 bytes ----------->| |<------------- 512 bytes --------------------->| CRs-Fixed: 2327052 Change-Id: I2646986ec424f7da31107ad01f673588734eaa52 --- core/wma/src/wma_mgmt.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/core/wma/src/wma_mgmt.c b/core/wma/src/wma_mgmt.c index 0a9ae0c04c11..f4c70f039981 100644 --- a/core/wma/src/wma_mgmt.c +++ b/core/wma/src/wma_mgmt.c @@ -2652,9 +2652,9 @@ static QDF_STATUS wma_store_bcn_tmpl(tp_wma_handle wma, uint8_t vdev_id, } len = *(u32 *) &bcn_info->beacon[0]; - if (len > SIR_MAX_BEACON_SIZE) { - WMA_LOGE("%s: Received beacon len %d exceeding max limit %d", - __func__, len, SIR_MAX_BEACON_SIZE); + if (len > SIR_MAX_BEACON_SIZE - sizeof(uint32_t)) { + WMA_LOGE("%s: Received beacon len %u exceeding max limit %lu", + __func__, len, SIR_MAX_BEACON_SIZE - sizeof(uint32_t)); return QDF_STATUS_E_INVAL; } WMA_LOGD("%s: Storing received beacon template buf to local buffer",