From 5f0fc2335f0cdbd782c3593b4f659a9a29774ebc Mon Sep 17 00:00:00 2001 From: Yun Park Date: Fri, 10 Feb 2017 10:34:57 -0800 Subject: [PATCH] qcacld-3.0: Remove op_string enum to avoid out of bounds access Fix potential buffer overflow by array index out of bounds. We need to add a new op_string entry whenever a new opcode added. Otherwise, the op_string entry for the additional opcodes could be accessed out-of-bounds. Change-Id: Ic09b19916b63d8bb83bf278361b8519268ee1787 CRs-Fixed: 2005340 --- core/hdd/src/wlan_hdd_ipa.c | 10 +--------- 1 file changed, 1 insertion(+), 9 deletions(-) diff --git a/core/hdd/src/wlan_hdd_ipa.c b/core/hdd/src/wlan_hdd_ipa.c index 76cb0a23136c..25d90950139f 100644 --- a/core/hdd/src/wlan_hdd_ipa.c +++ b/core/hdd/src/wlan_hdd_ipa.c @@ -593,14 +593,6 @@ static struct hdd_ipa_tx_hdr ipa_tx_hdr = { } }; -static const char *op_string[] = { - "TX_SUSPEND", - "TX_RESUME", - "RX_SUSPEND", - "RX_RESUME", - "STATS", -}; - static struct hdd_ipa_priv *ghdd_ipa; /* Local Function Prototypes */ @@ -1898,7 +1890,7 @@ static void hdd_ipa_uc_op_cb(struct op_msg_type *op_msg, void *usr_ctxt) hdd_ipa = (struct hdd_ipa_priv *)hdd_ctx->hdd_ipa; HDD_IPA_DP_LOG(QDF_TRACE_LEVEL_DEBUG, - "%s, OPCODE %s", __func__, op_string[msg->op_code]); + "OPCODE=%d", msg->op_code); if ((HDD_IPA_UC_OPCODE_TX_RESUME == msg->op_code) || (HDD_IPA_UC_OPCODE_RX_RESUME == msg->op_code)) {