A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-09 21:59:12 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix buffer overflow in __lim_process_roam_scan_offload_req

Browse source 
In validation code, change condition local_ie_len <= to always less than
QDF_ARRAY_SIZE(array) value, to avoid buffer overflow.

Change-Id: I9612ce6e922dd481747253b3b35d74060439c159
CRs-Fixed: 1082162
This commit is contained in:
Arif Hussain 2016-10-27 22:59:01 -07:00 • committed by qcabuildsw
commit 963331b5e2
1 changed files with 5 additions and 4 deletions
Download patch file Download diff file Expand all files Collapse all files

9
core/mac/src/pe/lim/lim_process_sme_req_messages.c
View file

@ -4156,16 +4156,17 @@ static void __lim_process_roam_scan_offload_req(tpAniSirGlobal mac_ctx,
local_ie_buf = qdf_mem_malloc(MAX_DEFAULT_SCAN_IE_LEN);
if (!local_ie_buf) {
lim_log(mac_ctx, LOGE, FL("Mem Alloc failed for local_ie_buf"));
lim_log(mac_ctx, LOGE,
FL("Mem Alloc failed for local_ie_buf"));
return;
}
local_ie_len = req_buffer->assoc_ie.length;
/* Update ext cap IE if present */
if (local_ie_len &&
!lim_update_ext_cap_ie(mac_ctx, req_buffer->assoc_ie.addIEdata,
local_ie_buf, &local_ie_len)) {
if (local_ie_len <=
!lim_update_ext_cap_ie(mac_ctx, req_buffer->assoc_ie.addIEdata,
local_ie_buf, &local_ie_len)) {
if (local_ie_len <
QDF_ARRAY_SIZE(req_buffer->assoc_ie.addIEdata)) {
req_buffer->assoc_ie.length = local_ie_len;
qdf_mem_copy(req_buffer->assoc_ie.addIEdata,