A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-14 16:46:15 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: Fix OOB access in utils_dfs_get_chan_list

Browse source 
Fix out of bound access for array "weight_list" with size 55 bytes
and declared on stack of function utils_dfs_get_chan_list. Same memory
is accessed in function policy_mgr_update_with_safe_channel_list with
index 127, leading to OOB access.

Change-Id: Ib7ba74e0096e90fd197bc563d2e82e497cf83759
CRs-Fixed: 2232833
This commit is contained in:
Naveen Rawat 2018-06-07 12:29:24 -07:00 • committed by nshrivas
commit 8d36892372
1 changed files with 2 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

4
umac/dfs/dispatcher/src/wlan_dfs_utils_api.c
View file

@ -536,8 +536,8 @@ static void utils_dfs_get_channel_list(struct wlan_objmgr_pdev *pdev,
static void utils_dfs_get_chan_list(struct wlan_objmgr_pdev *pdev,
struct dfs_channel *chan_list, uint32_t *num_chan)
{
uint8_t pcl_ch[NUM_CHANNELS] = {0};
uint8_t weight_list[NUM_CHANNELS] = {0};
uint8_t pcl_ch[QDF_MAX_NUM_CHAN] = {0};
uint8_t weight_list[QDF_MAX_NUM_CHAN] = {0};
uint32_t len;
uint32_t weight_len;
int i;