A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-11 15:11:48 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix buffer overflow

Browse source 
qcacld-2.0 to qcacld-3.0 propagation

In limInitPeerIdxpool, driver initializes gLimAssocStaLimit/
gLimIbssStaLimit entries of peer index pool. But there is a chance
of allocating less memory for peer index pool in peCreateSession
which can overwrite adjacent memory locations as maxStation can be
different from gLimAssocStaLimit/gLimIbssStaLimit. Fix this by
initializing maxStation entries.

Change-Id: I915e67fe7a15ebe622273af971d8a88ad78585cf
CRs-Fixed: 1025378
This commit is contained in:
Padma, Santhosh Kumar 2016-08-08 19:58:49 +05:30 • committed by Nishank Aggarwal
commit faaa7bd8e2
1 changed files with 11 additions and 17 deletions
Download patch file Download diff file Expand all files Collapse all files

28
core/mac/src/pe/lim/lim_aid_mgmt.c
View file

@ -50,37 +50,32 @@
#define LIM_START_PEER_IDX 1
/**
* lim_init_peer_idxpool()
* lim_init_peer_idxpool() -- initializes peer index pool
* @pMac: mac context
* @pSessionEntry: session entry
*
***FUNCTION:
* This function is called while starting a BSS at AP
* to initialize AID pool. This may also be called while
* starting/joining an IBSS if 'Association' is allowed
* in IBSS.
*
***LOGIC:
*
***ASSUMPTIONS:
* NA
*
***NOTE:
* NA
*
* @param pMac - Pointer to Global MAC structure
* @return None
* Return: None
*/
void lim_init_peer_idxpool(tpAniSirGlobal pMac, tpPESession pSessionEntry)
{
uint8_t i;
uint8_t maxAssocSta = pMac->lim.gLimAssocStaLimit;
uint8_t maxAssocSta = pMac->lim.maxStation;
pSessionEntry->gpLimPeerIdxpool[0] = 0;
#ifdef FEATURE_WLAN_TDLS
/* In station role, DPH_STA_HASH_INDEX_PEER (index 1) is reserved for peer */
/* station index corresponding to AP. Avoid choosing that index and get index */
/* starting from (DPH_STA_HASH_INDEX_PEER + 1) (index 2) for TDLS stations; */
/*
* In station role, DPH_STA_HASH_INDEX_PEER (index 1) is reserved
* for peer station index corresponding to AP. Avoid choosing that index
* and get index starting from (DPH_STA_HASH_INDEX_PEER + 1)
* (index 2) for TDLS stations;
*/
if (LIM_IS_STA_ROLE(pSessionEntry)) {
pSessionEntry->freePeerIdxHead = DPH_STA_HASH_INDEX_PEER + 1;
} else
@ -88,7 +83,6 @@ void lim_init_peer_idxpool(tpAniSirGlobal pMac, tpPESession pSessionEntry)
#ifdef QCA_IBSS_SUPPORT
if (LIM_IS_IBSS_ROLE(pSessionEntry)) {
pSessionEntry->freePeerIdxHead = LIM_START_PEER_IDX;
maxAssocSta = pMac->lim.gLimIbssStaLimit;
} else
#endif
{