From afa1553e878cbf2b710070711bca487691e555e6 Mon Sep 17 00:00:00 2001 From: Naveen Rawat Date: Mon, 27 Jun 2016 15:29:16 -0700 Subject: [PATCH] qcacld-3.0: Fix out of bound access in convert_qos_mapset_frame In function convert_qos_mapset_frame, restrict dscp_exceptions array access index to size of array Change-Id: Ieb153e4d263fbc1455b41bec71ec78b7c49558fc CRs-Fixed: 1034255 --- core/mac/src/sys/legacy/src/utils/src/utils_parser.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/core/mac/src/sys/legacy/src/utils/src/utils_parser.c b/core/mac/src/sys/legacy/src/utils/src/utils_parser.c index 093e40430ff0..e300de33aee2 100644 --- a/core/mac/src/sys/legacy/src/utils/src/utils_parser.c +++ b/core/mac/src/sys/legacy/src/utils/src/utils_parser.c @@ -708,8 +708,15 @@ void convert_qos_mapset_frame(tpAniSirGlobal pMac, tSirQosMapSet *Qos, tDot11fIEQosMapSet *dot11fIE) { uint8_t i, j = 0; + uint8_t qos_dscp_sz, dot11_dscp_sz; + + qos_dscp_sz = (sizeof(Qos->dscp_exceptions)/2); + dot11_dscp_sz = sizeof(dot11fIE->dscp_exceptions); Qos->num_dscp_exceptions = (dot11fIE->num_dscp_exceptions - 16) / 2; - for (i = 0; i < Qos->num_dscp_exceptions; i++) { + for (i = 0; + i < Qos->num_dscp_exceptions && + i < qos_dscp_sz && j < dot11_dscp_sz; + i++) { Qos->dscp_exceptions[i][0] = dot11fIE->dscp_exceptions[j]; j++; Qos->dscp_exceptions[i][1] = dot11fIE->dscp_exceptions[j];