From 6deb27f0c626e4965f0652f20a9cee1a8fe613d4 Mon Sep 17 00:00:00 2001 From: Tushnim Bhattacharyya Date: Tue, 5 Jun 2018 13:19:06 -0700 Subject: [PATCH] qcacld-3.0: Fix buffer overwrite in lim_mlm_add_bss() Fix buffer overwrite in lim_mlm_add_bss() by adding validated value for copy. Change-Id: I795c36e8bc27171eca96bffe05d413dc561a7d01 CRs-Fixed: 2254709 --- core/mac/src/pe/lim/lim_process_mlm_req_messages.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/mac/src/pe/lim/lim_process_mlm_req_messages.c b/core/mac/src/pe/lim/lim_process_mlm_req_messages.c index 68085a352086..a0e4f6400e52 100644 --- a/core/mac/src/pe/lim/lim_process_mlm_req_messages.c +++ b/core/mac/src/pe/lim/lim_process_mlm_req_messages.c @@ -514,7 +514,7 @@ lim_mlm_add_bss(tpAniSirGlobal mac_ctx, addbss_param->rateSet.numRates = SIR_MAC_RATESET_EID_MAX; } qdf_mem_copy(addbss_param->rateSet.rate, mlm_start_req->rateSet.rate, - mlm_start_req->rateSet.numRates); + addbss_param->rateSet.numRates); addbss_param->nwType = mlm_start_req->nwType; addbss_param->htCapable = mlm_start_req->htCapable;