A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-11 23:24:22 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix potential buffer overflow

Browse source 
In the function sap_clear_session_param, sapctx->sessionId can have
value more than max value allowed for the array
mac_ctx->sap.sapCtxList.

Add sanity check for the variable sapctx->sessionId

Change-Id: I846a8a1435de63d0a2e34f23bc407e0a8fa53eb2
CRs-Fixed: 2162255
This commit is contained in:
Sourav Mohapatra 2018-01-08 16:25:05 +05:30 • committed by snandini
commit ab088faa4a
1 changed files with 3 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
core/sap/src/sap_fsm.c
View file

@ -2079,6 +2079,9 @@ QDF_STATUS sap_clear_session_param(tHalHandle hal, struct sap_context *sapctx,
{
tpAniSirGlobal mac_ctx = PMAC_STRUCT(hal);
if (sapctx->sessionId >= SAP_MAX_NUM_SESSION)
return QDF_STATUS_E_FAILURE;
mac_ctx->sap.sapCtxList[sapctx->sessionId].sessionID =
CSR_SESSION_ID_INVALID;
mac_ctx->sap.sapCtxList[sapctx->sessionId].pSapContext = NULL;