A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-10 22:40:54 -04:00
Code Issues Projects Releases Packages Wiki Activity
No description
8,628 commits 10 branches 0 tags 2.1 GiB
  • C 98.2%
  • Assembly 1%
  • Makefile 0.3%
  • Shell 0.2%
  • Python 0.1%
Find a file
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Vignesh Viswanathan bdfbaa9cbf qcacld-3.0: Fix buffer overwrite in lim_send_probe_rsp_template_to_hal 
In function lim_send_probe_rsp_template_to_hal, memset is done for the
allocated packet for length nBytes which is calculated as size of payload +
MAC header + addn_ielen.
However, the buffer used psessionEntry->pSchProbeRspTemplate is allocated
for length 512 (SCH_MAX_PROBE_RESP_SIZE) only as part of create session.
This leads to a potential overflow of the memory if nBytes calculated is
greater than 512 leading to kernel panic while freeing the memory in
delete session.

Add sanity check to make sure we do not exceed the SCH_MAX_PROBE_RESP_SIZE
before doing a memset on the buffer.

Change-Id: I4657d34a429b1f0c11ac8ca24869727c222669b8
CRs-Fixed: 2160086
2017-12-25 23:26:31 -08:00
components qcacld-3.0: Rename pmo_ucfg_* APIs to ucfg_pmo_* APIs 2017-12-07 13:27:12 -08:00
core qcacld-3.0: Fix buffer overwrite in lim_send_probe_rsp_template_to_hal 2017-12-25 23:26:31 -08:00
uapi/linux qcacld-3.0: Enable Packetlog for Napier 2017-12-09 23:27:07 -08:00
Android.mk
Kbuild qcacld-3.0: Add sysfs interface for retrieving version information 2017-12-20 02:26:54 -08:00
Kconfig
Makefile
README.txt

README.txt 

This is CNSS WLAN Host Driver for products starting from iHelium