A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-11 23:24:22 -04:00
Code Issues Projects Releases Packages Wiki Activity
No description
10,543 commits 10 branches 0 tags 2.1 GiB
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Abhinav Kumar 7b40021398 qcacld-3.0: Possible buff overflow in sir_convert_assoc_resp_frame2_struct 
After parsing of Re/Association Response frame,
sir_convert_assoc_resp_frame2_struct populates association response
structure sSirAssocRsp. In case if FEATURE_WLAN_ESE is enabled,
the host runs a loop to memcopy for all WMM TSPEC info from the parsed
buffer to association response structure.
Currently, While copying parsed data to sSirAssocRsp,
sir_convert_assoc_resp_frame2_struct is passing (sizeof(tDot11fIEWMMTSPEC)
* ar->num_WMMTSPEC)) as length argument to qdf_mem_copy to copy individual
TSPECInfo. Which could result to buffer overflow, as size of per
TSPECInfo is only sizeof(tDot11fIEWMMTSPEC).

Pass correct length to qdf_mem_copy while coping TSPECInfo.

Change-Id: I9c74e3bbd387fda736a715625260d95c67f03ecc
CRs-Fixed: 2254946
2018-06-14 02:56:16 -07:00
components qcacld-3.0: Add support for getting dtim and beacon interval 2018-06-13 22:27:01 -07:00
configs qcacld-3.0: Add INI support for number of vdevs 2018-06-13 15:23:53 -07:00
core qcacld-3.0: Possible buff overflow in sir_convert_assoc_resp_frame2_struct 2018-06-14 02:56:16 -07:00
uapi/linux qcacld-3.0: Fix for parsing raw pktlog data 2018-06-13 12:30:32 -07:00
Android.mk
Kbuild qcacld-3.0: Add INI support for number of vdevs 2018-06-13 15:23:53 -07:00
Kconfig
Makefile qcacld-3.0: Pass WLAN_ROOT value for make clean 2018-06-09 00:09:16 -07:00
README.txt

README.txt 

This is CNSS WLAN Host Driver for products starting from iHelium