From ed07fad8f5ce8b41335a7ab1d8d15e8f88c34d42 Mon Sep 17 00:00:00 2001 From: Nagalakshmi Date: Tue, 29 Nov 2022 22:48:35 -0800 Subject: [PATCH] qcacld-3.0: Fix OOB in wma_scan_roam.c Currently in wma_extscan_hotlist_match_event_handler API, dest_hotlist get memory allocation based on numap which takes value from event->total_entries. But numap is limited to WMA_EXTSCAN_MAX_HOTLIST_ENTRIES and event->total_entries more than WMA_EXTSCAN_MAX_HOTLIST_ENTRIES can cause out of bound issue. Fix is to populate dest_hotlist->numOfAps from numap instead of event->total_entries to avoid any out of bound issue. Change-Id: I756f7e4a4dcd454508bba83d4a8bbbb139530905 CRs-Fixed: 3346781 --- core/wma/src/wma_scan_roam.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/wma/src/wma_scan_roam.c b/core/wma/src/wma_scan_roam.c index b3cf794cfb12..409c88336202 100644 --- a/core/wma/src/wma_scan_roam.c +++ b/core/wma/src/wma_scan_roam.c @@ -3564,7 +3564,7 @@ int wma_extscan_hotlist_match_event_handler(void *handle, return -ENOMEM; dest_ap = &dest_hotlist->ap[0]; - dest_hotlist->numOfAps = event->total_entries; + dest_hotlist->numOfAps = numap; dest_hotlist->requestId = event->config_request_id; if (event->first_entry_index +