From f1e6c20391a8950e5c812d9767acef5e0d358e95 Mon Sep 17 00:00:00 2001 From: hangtian Date: Thu, 23 Sep 2021 15:12:53 +0800 Subject: [PATCH] qcacld-3.0: Invalid rem_len computation in roam stats evt handler rem_len is calculated based on MAX size of the WMI message (WMI_SVC_MSG_MAX_SIZE) while extracting data from WMI_ROAM_STATS_EVENTID event data. Correct this by considering the actual message length received in the event. Change-Id: If24f732a8fdc0ad403e9b8a936ff8cfa0b7f7737 CRs-Fixed: 3035196 --- core/wma/src/wma_scan_roam.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/wma/src/wma_scan_roam.c b/core/wma/src/wma_scan_roam.c index 365e04d6d7dc..a3ec8ac65b4d 100644 --- a/core/wma/src/wma_scan_roam.c +++ b/core/wma/src/wma_scan_roam.c @@ -2192,7 +2192,7 @@ int wma_roam_stats_event_handler(WMA_HANDLE handle, uint8_t *event, num_tlv = MAX_ROAM_SCAN_STATS_TLV; } - rem_len = WMI_SVC_MSG_MAX_SIZE - sizeof(*fixed_param); + rem_len = len - sizeof(*fixed_param); if (rem_len < num_tlv * sizeof(wmi_roam_trigger_reason)) { wma_err_rl("Invalid roam trigger data"); goto err;