From 9bf4f33852dade3c767b9a61bacd97a78f0e4d00 Mon Sep 17 00:00:00 2001 From: Bala Venkatesh Date: Thu, 28 Jun 2018 11:13:25 +0530 Subject: [PATCH] qcacmn: Avoid possible buffer overflow In function tdls_ct_sampling_tx_rx, memcpy of unknown length buffer is done into fixed size struct array. Mem copying without checking length can lead to buffer overflow. Change-Id: I0608bd69d71ff1901f82b44d045963e9d383e6ce CRs-Fixed: 2269276 --- umac/tdls/core/src/wlan_tdls_ct.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/umac/tdls/core/src/wlan_tdls_ct.c b/umac/tdls/core/src/wlan_tdls_ct.c index 7c44278af44f..b3f28a458648 100644 --- a/umac/tdls/core/src/wlan_tdls_ct.c +++ b/umac/tdls/core/src/wlan_tdls_ct.c @@ -223,7 +223,8 @@ static void tdls_ct_sampling_tx_rx(struct tdls_vdev_priv_obj *tdls_vdev, return; } - mac_entries = tdls_vdev->valid_mac_entries; + mac_entries = QDF_MIN(tdls_vdev->valid_mac_entries, + WLAN_TDLS_CT_TABLE_SIZE); qdf_mem_copy(mac_table, tdls_vdev->ct_peer_table, (sizeof(struct tdls_conn_tracker_mac_table)) * mac_entries);