A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-25 22:23:14 -04:00
Code Issues Projects Releases Packages Wiki Activity

Merge "qcacld-3.0: Fix buffer overflow in wmi roam scan filter cmd" into wlan-cld3.driver.lnx.2.0-dev

Browse source
This commit is contained in:
CNSS_WLAN Service 2017-07-12 13:17:25 -07:00 • committed by Gerrit - the friendly Code Review server
commit 5467ec3fba
1 changed files with 1 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

14
core/wma/src/wma_scan_roam.c
View file

@ -1577,7 +1577,7 @@ static QDF_STATUS wma_roam_scan_filter(tp_wma_handle wma_handle,
{
int i;
QDF_STATUS status = QDF_STATUS_SUCCESS;
uint32_t len = 0, num_bssid_black_list = 0, num_ssid_white_list = 0,
uint32_t num_bssid_black_list = 0, num_ssid_white_list = 0,
num_bssid_preferred_list = 0;
uint32_t op_bitmap = 0;
struct roam_ext_params *roam_params;
@ -1596,23 +1596,16 @@ static QDF_STATUS wma_roam_scan_filter(tp_wma_handle wma_handle,
op_bitmap |= 0x1;
num_bssid_black_list =
roam_params->num_bssid_avoid_list;
len = num_bssid_black_list * sizeof(wmi_mac_addr);
len += WMI_TLV_HDR_SIZE;
break;
case REASON_ROAM_SET_SSID_ALLOWED:
op_bitmap |= 0x2;
num_ssid_white_list =
roam_params->num_ssid_allowed_list;
len = num_ssid_white_list * sizeof(wmi_ssid);
len += WMI_TLV_HDR_SIZE;
break;
case REASON_ROAM_SET_FAVORED_BSSID:
op_bitmap |= 0x4;
num_bssid_preferred_list =
roam_params->num_bssid_favored;
len = num_bssid_preferred_list * sizeof(wmi_mac_addr);
len += WMI_TLV_HDR_SIZE;
len += num_bssid_preferred_list * sizeof(A_UINT32);
break;
default:
WMA_LOGD("%s : Roam Filter need not be sent", __func__);
@ -1626,11 +1619,7 @@ static QDF_STATUS wma_roam_scan_filter(tp_wma_handle wma_handle,
*/
op_bitmap = 0x2 | 0x4;
num_ssid_white_list = roam_params->num_ssid_allowed_list;
len = num_ssid_white_list * sizeof(wmi_ssid);
num_bssid_preferred_list = roam_params->num_bssid_favored;
len += num_bssid_preferred_list * sizeof(wmi_mac_addr);
len += num_bssid_preferred_list * sizeof(A_UINT32);
len += (2 * WMI_TLV_HDR_SIZE);
}
/* fill in fixed values */
@ -1639,7 +1628,6 @@ static QDF_STATUS wma_roam_scan_filter(tp_wma_handle wma_handle,
params->num_bssid_black_list = num_bssid_black_list;
params->num_ssid_white_list = num_ssid_white_list;
params->num_bssid_preferred_list = num_bssid_preferred_list;
params->len = len;
qdf_mem_copy(params->bssid_avoid_list, roam_params->bssid_avoid_list,
MAX_BSSID_AVOID_LIST * sizeof(struct qdf_mac_addr));