From 3107b75f2c3caf6072cc6480116fc303bcaf921d Mon Sep 17 00:00:00 2001
From: Prakash Dhavali <pdhavali@codeaurora.org>
Date: Mon, 28 Nov 2016 14:35:06 +0530
Subject: [PATCH] qcacld-3.0: Validate station id

In function __hdd_softap_hard_start_xmit, station id is
not validated with max station count, this might lead to
a buffer overflow situation for array aStaInfo in SapCtx.

Validate station id with max sta count.

CRs-Fixed: 1093122
Change-Id: If9f59c5a7b76845bb7783a96453e595b5afa4f30
---
 core/hdd/src/wlan_hdd_softap_tx_rx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/hdd/src/wlan_hdd_softap_tx_rx.c b/core/hdd/src/wlan_hdd_softap_tx_rx.c
index 56c0cdedce9e..bd95c8996467 100644
--- a/core/hdd/src/wlan_hdd_softap_tx_rx.c
+++ b/core/hdd/src/wlan_hdd_softap_tx_rx.c
@@ -295,7 +295,7 @@ static int __hdd_softap_hard_start_xmit(struct sk_buff *skb,
 			goto drop_pkt;
 		}
 
-		if (STAId == HDD_WLAN_INVALID_STA_ID) {
+		if (STAId >= WLAN_MAX_STA_COUNT) {
 			QDF_TRACE(QDF_MODULE_ID_HDD_SAP_DATA,
 				  QDF_TRACE_LEVEL_WARN,
 				  "%s: Failed to find right station", __func__);