From e8b23d5cdd7a9e07a7d892683a2f79e331a9029a Mon Sep 17 00:00:00 2001
From: Kiran Kumar Lokere <klokere@codeaurora.org>
Date: Fri, 14 Aug 2020 16:37:02 -0700
Subject: [PATCH] qcacld-3.0: Possible mem corruption while processing BCN RPT
 Req

The beacon report logic has the maximum 7 reports to include in
one measurement report frame. Update the no.of reports value
in the frame packing structure to pack 7 reports in one frame.

Change-Id: I92b33f024274765e0f8cf1386197a9dba05b4bab
CRs-Fixed: 2755806
---
 core/mac/src/cfg/cfgUtil/dot11f.frms           | 2 +-
 core/mac/src/include/dot11f.h                  | 4 ++--
 core/mac/src/sys/legacy/src/utils/src/dot11f.c | 4 ++--
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/core/mac/src/cfg/cfgUtil/dot11f.frms b/core/mac/src/cfg/cfgUtil/dot11f.frms
index a0096303e8eb..623a2d8706e4 100644
--- a/core/mac/src/cfg/cfgUtil/dot11f.frms
+++ b/core/mac/src/cfg/cfgUtil/dot11f.frms
@@ -4124,7 +4124,7 @@ FRAME RadioMeasurementReport
    FF   Action;
    FF   DialogToken;
    //Measurement Report elements.
-   MANDIE MeasurementReport[1..4];
+   MANDIE MeasurementReport[1..7];
 }
 
 FRAME LinkMeasurementRequest
diff --git a/core/mac/src/include/dot11f.h b/core/mac/src/include/dot11f.h
index 810877683cf2..c1f87cfdb303 100644
--- a/core/mac/src/include/dot11f.h
+++ b/core/mac/src/include/dot11f.h
@@ -26,7 +26,7 @@
  *
  *
  * This file was automatically generated by 'framesc'
- * Tue Aug 11 23:34:13 2020 from the following file(s):
+ * Fri Aug 14 16:33:26 2020 from the following file(s):
  *
  * dot11f.frms
  *
@@ -10504,7 +10504,7 @@ typedef struct sDot11fRadioMeasurementReport{
 	tDot11fFfAction                   Action;
 	tDot11fFfDialogToken              DialogToken;
 	uint16_t                          num_MeasurementReport;
-	tDot11fIEMeasurementReport        MeasurementReport[4];
+	tDot11fIEMeasurementReport        MeasurementReport[7];
 } tDot11fRadioMeasurementReport;
 
 #define DOT11F_RADIOMEASUREMENTREPORT (24)
diff --git a/core/mac/src/sys/legacy/src/utils/src/dot11f.c b/core/mac/src/sys/legacy/src/utils/src/dot11f.c
index b43128bf6ba7..e740a89c650f 100644
--- a/core/mac/src/sys/legacy/src/utils/src/dot11f.c
+++ b/core/mac/src/sys/legacy/src/utils/src/dot11f.c
@@ -24,7 +24,7 @@
  *
  *
  * This file was automatically generated by 'framesc'
- * Tue Aug 11 23:34:13 2020 from the following file(s):
+ * Fri Aug 14 16:33:26 2020 from the following file(s):
  *
  * dot11f.frms
  *
@@ -11488,7 +11488,7 @@ static const tIEDefn IES_RadioMeasurementReport[] = {
 	{ offsetof(tDot11fRadioMeasurementReport, MeasurementReport),
 	offsetof(tDot11fIEMeasurementReport, present),
 	offsetof(tDot11fRadioMeasurementReport, num_MeasurementReport),
-	"MeasurementReport", 4, 5, 31, SigIeMeasurementReport, {0, 0, 0, 0, 0},
+	"MeasurementReport", 7, 5, 31, SigIeMeasurementReport, {0, 0, 0, 0, 0},
 	0, DOT11F_EID_MEASUREMENTREPORT, 0, 1, },
 	{0, 0, 0, NULL, 0, 0, 0, 0, {0, 0, 0, 0, 0}, 0, 0xff, 0, },};