From bf4774a59d24cc1d533f253de0e6e2fa1b154c4d Mon Sep 17 00:00:00 2001 From: Gururaj Pandurangi Date: Wed, 26 Feb 2020 11:00:07 -0800 Subject: [PATCH] qcacld-3.0: Fix while condition in rrm_fill_beacon_ies() In function rrm_fill_beacon_ies, do while loop is checked for BcnNumIes if it is greater than IE length 0. Fix the check to be greater than 2 as the first two bytes is IE header(element ID and IE length fields both 1 byte each.) Change-Id: I11e5de481cd49a22acafee938fbe73f839f5b0e4 CRs-Fixed: 2626729 --- core/mac/src/pe/rrm/rrm_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/mac/src/pe/rrm/rrm_api.c b/core/mac/src/pe/rrm/rrm_api.c index f9438a9e1959..ec412ec91a41 100644 --- a/core/mac/src/pe/rrm/rrm_api.c +++ b/core/mac/src/pe/rrm/rrm_api.c @@ -828,7 +828,7 @@ rrm_fill_beacon_ies(struct mac_context *mac, uint8_t *pIes, pIes += sizeof(uint16_t); } - while (BcnNumIes > 0) { + while (BcnNumIes >= 2) { len = *(pBcnIes + 1); len += 2; /* element id + length. */ pe_debug("EID = %d, len = %d total = %d",