A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-11 23:24:22 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: Fix buffer overflow when radiotap header is larger than available headroom

Browse source 
The condition which detects if the length of the radiotap header is
greater than the available headroom in the skb is incorrect.

Correction to check if sufficient headroom is available
for updating the radiotap header.

Change-Id: I71c140c6af415678efe66cff2f16b8cabc62697a
CRs-Fixed: 2047909
This commit is contained in:
Rakesh Pillai 2017-05-16 19:49:49 +05:30 • committed by snandini
commit 847482ff8e
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
qdf/linux/src/qdf_nbuf.c
View file

@ -2748,7 +2748,7 @@ unsigned int qdf_nbuf_update_radiotap(struct mon_rx_status *rx_status,
}
rthdr->it_len = cpu_to_le16(rtap_len);
if ((headroom_sz - rtap_len) < 0) {
if (headroom_sz < rtap_len) {
qdf_print("ERROR: not enough space to update radiotap\n");
return 0;
}