A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-14 16:46:15 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix incorrect handling of additional IE in assoc response

Browse source 
Fix incorrect handling of additional IE coming from userspace in assoc
response. additonal_ielen field used for the logical checks and buffer
manipulation does not contain correct value which might lead to incorrect
behavior.

Change-Id: I483696d1fa1a731e9afd0a4ea134900d81be7b43
CRs-Fixed: 998427
This commit is contained in:
Krishna Kumaar Natarajan 2016-04-01 16:27:51 -07:00 • committed by Akash Patel
commit e4e3a14cf4
1 changed files with 4 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

7
core/mac/src/pe/lim/lim_send_management_frames.c
View file

@ -1296,11 +1296,12 @@ lim_send_assoc_rsp_mgmt_frame(tpAniSirGlobal mac_ctx,
bytes = sizeof(tSirMacMgmtHdr) + payload;
if (assoc_req != NULL) {
addn_ie_len = (pe_session->addIeParams.assocRespDataLen != 0);
addn_ie_len = pe_session->addIeParams.assocRespDataLen;
/* Nonzero length indicates Assoc rsp IE available */
if (addn_ie_len <= WNI_CFG_ASSOC_RSP_ADDNIE_DATA_LEN
&& (bytes + addn_ie_len) <= SIR_MAX_PACKET_SIZE) {
if (addn_ie_len > 0 &&
addn_ie_len <= WNI_CFG_ASSOC_RSP_ADDNIE_DATA_LEN &&
(bytes + addn_ie_len) <= SIR_MAX_PACKET_SIZE) {
qdf_mem_copy(add_ie,
pe_session->addIeParams.assocRespData_buff,
pe_session->addIeParams.assocRespDataLen);