A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-15 01:01:56 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: Avoid possible buffer overflow

Browse source 
In function tdls_ct_sampling_tx_rx, memcpy of
unknown length buffer is done into fixed size
struct array. Mem copying without checking
length can lead to buffer overflow.

Change-Id: I0608bd69d71ff1901f82b44d045963e9d383e6ce
CRs-Fixed: 2269276
This commit is contained in:
Bala Venkatesh 2018-06-28 11:13:25 +05:30 • committed by nshrivas
commit 9bf4f33852
1 changed files with 2 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
umac/tdls/core/src/wlan_tdls_ct.c
View file

@ -223,7 +223,8 @@ static void tdls_ct_sampling_tx_rx(struct tdls_vdev_priv_obj *tdls_vdev,
return;
}
mac_entries = tdls_vdev->valid_mac_entries;
mac_entries = QDF_MIN(tdls_vdev->valid_mac_entries,
WLAN_TDLS_CT_TABLE_SIZE);
qdf_mem_copy(mac_table, tdls_vdev->ct_peer_table,
(sizeof(struct tdls_conn_tracker_mac_table)) * mac_entries);