No description
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Rajeev Kumar 0f22d9370e qcacld-3.0: Avoid heap overflow during cfg80211 vendor scan request
WLAN driver's vendor scan request handler function declares ie_len
as uint8_t whereas kernel's cfg80211_scan_request ie_len is declared
as size_t. This type mismatch for ie_len leads to WLAN driver allocating
less memory on heap because of implicit integer overflow when kernel's
ie_len(declared as size_t) is bigger than hex 0xFF and when scan request
data is copied it overflows the allocated heap memory.

In WLAN driver's vendor scan request handler declare ie_len and len also
of type size_t such that always correct size heap memory is allocated and
there is no heap overflow during memory copy.

Change-Id: I240113d34c561c7155303b0b8b253c0cbaf7724b
CRs-Fixed: 2145573
2017-11-20 15:21:07 -08:00
components qcacld-3.0: Use enum QDF_OPMODE 2017-11-10 00:27:42 -08:00
core qcacld-3.0: Avoid heap overflow during cfg80211 vendor scan request 2017-11-20 15:21:07 -08:00
uapi/linux qcacld-3.0: Fix checkpatch warnings (QUOTED_WHITESPACE_BEFORE_NEWLINE) 2017-10-24 16:40:56 -07:00
Android.mk qcacld-3.0: Correct symbolic link for wlan.ko 2017-08-06 05:00:09 -07:00
Kbuild qcacld-3.0: Rename target sdxhedgehog to sdx20 2017-11-20 04:07:26 -08:00
Kconfig qcacld-3.0: Add Kconfig option for feature flag 2017-10-18 07:49:26 -07:00
Makefile qcacld-3.0: accept module name externally 2016-06-01 10:48:46 -07:00
README.txt

This is CNSS WLAN Host Driver for products starting from iHelium