diff options
| author | Dundi Raviteja <dundi@codeaurora.org> | 2018-08-13 15:32:42 +0530 |
|---|---|---|
| committer | Dundi Raviteja <dundi@codeaurora.org> | 2018-08-13 15:37:01 +0530 |
| commit | d660b47e8abb2efc4ecfc328dc144760f27df8ac (patch) | |
| tree | 1f553ff4edfe7fb7ff9c1e837a77179223ae87b2 | |
| parent | f1d2db8bb559e74d044da5fc587a23becde1ca3a (diff) | |
qcacld-2.0: Possible kernel info leak in sme_updateP2pIe()
Currently in sme_updateP2pIe() function probe response
information element buffer is dumping before copying
the data into it, this may leads to kernel info leak.
To address this issue, copy data to information element
buffer before dumping it.
Change-Id: I65e9f83b1a245c8891ad914480fbacd744fdb0a0
CRs-Fixed: 2291491
| -rw-r--r-- | CORE/SME/src/sme_common/sme_Api.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/CORE/SME/src/sme_common/sme_Api.c b/CORE/SME/src/sme_common/sme_Api.c index 935ca60138e5..2f9cd31e2185 100644 --- a/CORE/SME/src/sme_common/sme_Api.c +++ b/CORE/SME/src/sme_common/sme_Api.c @@ -8187,11 +8187,11 @@ eHalStatus sme_updateP2pIe(tHalHandle hHal, void *p2pIe, tANI_U32 p2pIeLength) { pMac->p2pContext.probeRspIeLength = p2pIeLength; + vos_mem_copy((tANI_U8 *)pMac->p2pContext.probeRspIe, p2pIe, + p2pIeLength); sirDumpBuf( pMac, SIR_LIM_MODULE_ID, LOG2, pMac->p2pContext.probeRspIe, pMac->p2pContext.probeRspIeLength ); - vos_mem_copy((tANI_U8 *)pMac->p2pContext.probeRspIe, p2pIe, - p2pIeLength); } //release the lock for the sme object |