A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-25 22:23:14 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix integer Underflow in csr_update_fils_params_rso

Browse source 
Fix integer underflow in csr_update_fils_params_rso as this may
cause buffer overflow.

Change-Id: I25b31f5c0f207be09ac30d5f95911d3866d12d66
CRs-Fixed: 2204872
This commit is contained in:
Arif Hussain 2018-04-04 07:16:58 -07:00 • committed by nshrivas
commit a216f678bf
1 changed files with 13 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

19
core/sme/src/csr/csr_api_roam.c
View file

@ -19161,6 +19161,7 @@ static void csr_update_fils_params_rso(tpAniSirGlobal mac,
{
struct roam_fils_params *roam_fils_params;
struct cds_fils_connection_info *fils_info;
uint32_t usr_name_len;
if (!session->pCurRoamProfile)
return;
@ -19182,13 +19183,19 @@ static void csr_update_fils_params_rso(tpAniSirGlobal mac,
return;
}
usr_name_len = copy_all_before_char(fils_info->keyname_nai,
sizeof(fils_info->keyname_nai),
roam_fils_params->username,
sizeof(roam_fils_params->username),
'@');
if (fils_info->key_nai_length <= usr_name_len) {
sme_err("Fils info len error: key nai len %d, user name len %d",
fils_info->key_nai_length, usr_name_len);
return;
}
roam_fils_params->username_length = usr_name_len;
req_buffer->is_fils_connection = true;
roam_fils_params->username_length =
copy_all_before_char(fils_info->keyname_nai,
sizeof(fils_info->keyname_nai),
roam_fils_params->username,
sizeof(roam_fils_params->username),
'@');
roam_fils_params->next_erp_seq_num =
(fils_info->sequence_number + 1);