A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-13 00:00:00 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix buffer overwrite problem in CCXBEACONREQ

Browse source 
This is a propagation from qcacld-2.0 to qcacld-3.0.

Set the number of IE fields to minimum of input data and
SIR_ESE_MAX_MEAS_IE_REQS

Change-Id: Ie53cfec7872ab69530bbb8932f9f9e85fb319f92
CRs-Fixed: 993561
This commit is contained in:
Srinivas Girigowda 2016-07-19 16:21:29 -07:00 • committed by qcabuildsw
commit 476deeb893
1 changed files with 3 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
core/hdd/src/wlan_hdd_ioctl.c
View file

@ -2642,7 +2642,7 @@ static int hdd_parse_ese_beacon_req(uint8_t *pValue,
if ('\0' == *inPtr)
return -EINVAL;
/* get the first argument ie measurement token */
/* Getting the first argument ie Number of IE fields */
v = sscanf(inPtr, "%31s ", buf);
if (1 != v)
return -EINVAL;
@ -2651,10 +2651,10 @@ static int hdd_parse_ese_beacon_req(uint8_t *pValue,
if (v < 0)
return -EINVAL;
tempInt = QDF_MIN(tempInt, SIR_ESE_MAX_MEAS_IE_REQS);
pEseBcnReq->numBcnReqIe = tempInt;
hdd_info("Number of Bcn Req Ie fields(%d)",
pEseBcnReq->numBcnReqIe);
hdd_info("Number of Bcn Req Ie fields: %d", pEseBcnReq->numBcnReqIe);
for (j = 0; j < (pEseBcnReq->numBcnReqIe); j++) {
for (i = 0; i < 4; i++) {