A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-14 16:46:15 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix the wrap-around issue in rrm_fill_beacon_ies

Browse source 
Currently BcnNumIes is uint8_t, which is used to hold ie length,
and it cannot be used to hold if ie length is greater than 255,
it will wrap-around to zero or smaller number.

So change BcnNumIes variable type from uint8_t to uint16_t.

Also change to bss desc copy logic in
sme_rrm_send_beacon_report_xmit_ind function.

Change-Id: Ie92a9afbf6e3674a0730f5f48210424b1d34386d
CRs-Fixed: 2124579
This commit is contained in:
Arif Hussain 2017-10-18 15:33:11 -07:00 • committed by snandini
commit 2fd002410a
2 changed files with 7 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

4
core/mac/src/pe/rrm/rrm_api.c
View file

@ -693,7 +693,7 @@ rrm_fill_beacon_ies(tpAniSirGlobal pMac,
uint8_t *eids, uint8_t numEids, tpSirBssDescription pBssDesc)
{
uint8_t len, *pBcnIes, count = 0, i;
uint8_t BcnNumIes;
uint16_t BcnNumIes;
if ((pIes == NULL) || (pNumIes == NULL) || (pBssDesc == NULL)) {
pe_err("Invalid parameters");
@ -703,7 +703,7 @@ rrm_fill_beacon_ies(tpAniSirGlobal pMac,
numEids = (eids == NULL) ? 0 : numEids;
pBcnIes = (uint8_t *) &pBssDesc->ieFields[0];
BcnNumIes = (uint8_t) GET_IE_LEN_IN_BSS(pBssDesc->length);
BcnNumIes = GET_IE_LEN_IN_BSS(pBssDesc->length);
*pNumIes = 0;

14
core/sme/src/rrm/sme_rrm.c
View file

@ -173,7 +173,8 @@ sme_rrm_send_beacon_report_xmit_ind(tpAniSirGlobal mac_ctx,
{
tpSirBssDescription bss_desc = NULL;
tpSirBeaconReportXmitInd beacon_rep;
uint16_t length, ie_len, tot_len;
uint16_t length;
uint32_t size;
uint8_t i = 0, j = 0, counter = 0;
tCsrScanResultInfo *cur_result = NULL;
QDF_STATUS status = QDF_STATUS_E_FAILURE;
@ -208,18 +209,13 @@ sme_rrm_send_beacon_report_xmit_ind(tpAniSirGlobal mac_ctx,
bss_desc = &cur_result->BssDescriptor;
if (bss_desc == NULL)
break;
ie_len = GET_IE_LEN_IN_BSS(bss_desc->length);
tot_len = ie_len + sizeof(*bss_desc);
beacon_rep->pBssDescription[i] =
qdf_mem_malloc(tot_len);
size = bss_desc->length + sizeof(bss_desc->length);
beacon_rep->pBssDescription[i] = qdf_mem_malloc(size);
if (NULL ==
beacon_rep->pBssDescription[i])
break;
qdf_mem_copy(beacon_rep->pBssDescription[i],
bss_desc, sizeof(tSirBssDescription));
qdf_mem_copy(
&beacon_rep->pBssDescription[i]->ieFields[0],
bss_desc->ieFields, ie_len);
bss_desc, size);
bss_desc_to_free[i] =
beacon_rep->pBssDescription[i];
sme_debug("RRM Result Bssid = " MAC_ADDRESS_STR