A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-10 22:40:54 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix out-of-bounds access in ol_rx_indication_handler

Browse source 
Fix overrunning callee's array of size 19 by evaluating argument tid
not to pass the maximum number.

Change-Id: I993339f4b9aea51e9566d213c9828825c5f2bf66
CRs-Fixed: 2232744
This commit is contained in:
Yun Park 2018-06-05 11:35:59 -07:00 • committed by nshrivas
commit 4dcc193aa8
1 changed files with 6 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
core/dp/txrx/ol_rx.c
View file

@ -538,6 +538,12 @@ ol_rx_indication_handler(ol_txrx_pdev_handle pdev,
*/
ol_rx_reorder_peer_cleanup(vdev, peer);
} else {
if (tid >= OL_TXRX_NUM_EXT_TIDS) {
ol_txrx_err("%s: invalid tid, %u\n",
__func__, tid);
WARN_ON(1);
return;
}
ol_rx_reorder_flush(vdev, peer, tid, seq_num_start,
seq_num_end, htt_rx_flush_release);
}