A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-25 22:23:14 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Add bound check before writing to channel list

Browse source 
In function rrm_process_beacon_report_req, add bound check before
writing to channel list which is of fixed size.

Change-Id: I3c80974bba84a96f7b85e4ce62bbb01c23b4babf
CRs-Fixed: 2060138
This commit is contained in:
Naveen Rawat 2017-06-19 11:57:31 -07:00 • committed by snandini
commit d85a390de4
1 changed files with 12 additions and 10 deletions
Download patch file Download diff file Expand all files Collapse all files

26
core/mac/src/pe/rrm/rrm_api.c
View file

@ -632,23 +632,25 @@ rrm_process_beacon_report_req(tpAniSirGlobal pMac,
pSmeBcnReportReq->channelList.numChannels = num_channels;
if (pBeaconReq->measurement_request.Beacon.num_APChannelReport) {
uint8_t *pChanList =
pSmeBcnReportReq->channelList.channelNumber;
uint8_t *ch_lst = pSmeBcnReportReq->channelList.channelNumber;
uint8_t len;
uint16_t ch_ctr = 0;
for (num_APChanReport = 0;
num_APChanReport <
pBeaconReq->measurement_request.Beacon.num_APChannelReport;
num_APChanReport++) {
qdf_mem_copy(pChanList,
pBeaconReq->measurement_request.Beacon.
APChannelReport[num_APChanReport].
channelList,
pBeaconReq->measurement_request.Beacon.
APChannelReport[num_APChanReport].
num_channelList);
len = pBeaconReq->measurement_request.Beacon.
APChannelReport[num_APChanReport].num_channelList;
if (ch_ctr + len >
sizeof(pSmeBcnReportReq->channelList.channelNumber))
break;
pChanList +=
pBeaconReq->measurement_request.Beacon.
APChannelReport[num_APChanReport].num_channelList;
qdf_mem_copy(&ch_lst[ch_ctr],
pBeaconReq->measurement_request.Beacon.
APChannelReport[num_APChanReport].
channelList, len);
ch_ctr += len;
}
}
/* Send request to SME. */