A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-14 08:36:12 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix OOB in wma_scan_roam.c

Browse source 
Currently in wma_extscan_hotlist_match_event_handler
API, dest_hotlist get memory allocation based on numap
which takes value from event->total_entries.
But numap is limited to WMA_EXTSCAN_MAX_HOTLIST_ENTRIES
and event->total_entries more than WMA_EXTSCAN_MAX_HOTLIST_ENTRIES
can cause out of bound issue.

Fix is to populate dest_hotlist->numOfAps from numap
instead of event->total_entries to avoid any out of bound issue.

Change-Id: I756f7e4a4dcd454508bba83d4a8bbbb139530905
CRs-Fixed: 3346781
This commit is contained in:
Nagalakshmi 2022-11-29 22:48:35 -08:00 • committed by Gerrit - the friendly Code Review server
commit ed07fad8f5
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
core/wma/src/wma_scan_roam.c
View file

@ -3564,7 +3564,7 @@ int wma_extscan_hotlist_match_event_handler(void *handle,
return -ENOMEM;
dest_ap = &dest_hotlist->ap[0];
dest_hotlist->numOfAps = event->total_entries;
dest_hotlist->numOfAps = numap;
dest_hotlist->requestId = event->config_request_id;
if (event->first_entry_index +