From 8d3689237251ec6edfe7a05ae6f8338e7022e6c3 Mon Sep 17 00:00:00 2001 From: Naveen Rawat Date: Thu, 7 Jun 2018 12:29:24 -0700 Subject: [PATCH] qcacmn: Fix OOB access in utils_dfs_get_chan_list Fix out of bound access for array "weight_list" with size 55 bytes and declared on stack of function utils_dfs_get_chan_list. Same memory is accessed in function policy_mgr_update_with_safe_channel_list with index 127, leading to OOB access. Change-Id: Ib7ba74e0096e90fd197bc563d2e82e497cf83759 CRs-Fixed: 2232833 --- umac/dfs/dispatcher/src/wlan_dfs_utils_api.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/umac/dfs/dispatcher/src/wlan_dfs_utils_api.c b/umac/dfs/dispatcher/src/wlan_dfs_utils_api.c index cd45401c629e..e9f4e3a7847b 100644 --- a/umac/dfs/dispatcher/src/wlan_dfs_utils_api.c +++ b/umac/dfs/dispatcher/src/wlan_dfs_utils_api.c @@ -536,8 +536,8 @@ static void utils_dfs_get_channel_list(struct wlan_objmgr_pdev *pdev, static void utils_dfs_get_chan_list(struct wlan_objmgr_pdev *pdev, struct dfs_channel *chan_list, uint32_t *num_chan) { - uint8_t pcl_ch[NUM_CHANNELS] = {0}; - uint8_t weight_list[NUM_CHANNELS] = {0}; + uint8_t pcl_ch[QDF_MAX_NUM_CHAN] = {0}; + uint8_t weight_list[QDF_MAX_NUM_CHAN] = {0}; uint32_t len; uint32_t weight_len; int i;