From 5428570e416f05fe2eaebd03cd5b18e8c0a8be47 Mon Sep 17 00:00:00 2001 From: Krunal Soni Date: Tue, 9 Jan 2018 11:00:28 -0800 Subject: [PATCH] qcacmn: Check pcl array size against QDF_MAX_NUM_CHAN While populating preferred channel list array, length has not been checked against QDF_MAX_NUM_CHAN which is size of PCL. Fix it by checking indices and length against QDF_MAX_NUM_CHAN CRs-Fixed: 2169424 Change-Id: I8c4d050bfc7040fba052eb42b32a91302a0a0ecb --- umac/cmn_services/policy_mgr/src/wlan_policy_mgr_pcl.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/umac/cmn_services/policy_mgr/src/wlan_policy_mgr_pcl.c b/umac/cmn_services/policy_mgr/src/wlan_policy_mgr_pcl.c index ce627c690a70..74f86baa2dd0 100644 --- a/umac/cmn_services/policy_mgr/src/wlan_policy_mgr_pcl.c +++ b/umac/cmn_services/policy_mgr/src/wlan_policy_mgr_pcl.c @@ -1540,6 +1540,10 @@ QDF_STATUS policy_mgr_modify_sap_pcl_based_on_mandatory_channel( for (i = 0; i < *pcl_len_org; i++) { found = false; + if (i >= QDF_MAX_NUM_CHAN) { + policy_mgr_debug("index is exceeding QDF_MAX_NUM_CHAN"); + break; + } for (j = 0; j < pm_ctx->sap_mandatory_channels_len; j++) { if (pcl_list_org[i] == pm_ctx->sap_mandatory_channels[j]) { @@ -1547,7 +1551,7 @@ QDF_STATUS policy_mgr_modify_sap_pcl_based_on_mandatory_channel( break; } } - if (found) { + if (found && (pcl_len < QDF_MAX_NUM_CHAN)) { pcl_list[pcl_len] = pcl_list_org[i]; weight_list[pcl_len++] = weight_list_org[i]; }