diff options
| author | CNSS_WLAN Service <cnssbldsw@qualcomm.com> | 2018-05-31 13:10:48 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2018-05-31 13:10:48 -0700 |
| commit | 0ce2ce216bb170cfd676c10ce590aa4b2566d6f5 (patch) | |
| tree | 39800fd46886e1f5fa41fffd3cf18c081f238917 | |
| parent | f49faf17bc3efe1439b2f0d75150e3c74dc709fb (diff) | |
| parent | e244d458c0df8d265dd400337d24d8f8868e7795 (diff) | |
Merge "qcacld-2.0: Modify addition of proper length to payload" into wlan-cld2.driver.lnx.1.0
| -rw-r--r-- | CORE/SVC/src/ptt/wlan_ptt_sock_svc.c | 15 |
1 files changed, 3 insertions, 12 deletions
diff --git a/CORE/SVC/src/ptt/wlan_ptt_sock_svc.c b/CORE/SVC/src/ptt/wlan_ptt_sock_svc.c index c7b2baf6d1bf..39d3a4b1acc7 100644 --- a/CORE/SVC/src/ptt/wlan_ptt_sock_svc.c +++ b/CORE/SVC/src/ptt/wlan_ptt_sock_svc.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2012-2017 The Linux Foundation. All rights reserved. + * Copyright (c) 2012-2018 The Linux Foundation. All rights reserved. * * Previously licensed under the ISC license by Qualcomm Atheros, Inc. * @@ -125,7 +125,7 @@ int ptt_sock_send_msg_to_app(tAniHdr *wmsg, int radio, int src_mod, int pid) __func__, radio); return -EINVAL; } - payload_len = wmsg_length + sizeof(wnl->radio) + sizeof(tAniHdr); + payload_len = wmsg_length + sizeof(wnl->radio); tot_msg_len = NLMSG_SPACE(payload_len); if ((skb = dev_alloc_skb(tot_msg_len)) == NULL) { PTT_TRACE(VOS_TRACE_LEVEL_ERROR, "%s: dev_alloc_skb() failed for msg size[%d]\n", @@ -271,18 +271,9 @@ static void ptt_cmd_handler(const void *data, int data_len, void *ctx, int pid) payload = (ptt_app_reg_req *)(nla_data(tb[CLD80211_ATTR_DATA])); length = be16_to_cpu(payload->wmsg.length); - if ((USHRT_MAX - length) < (sizeof(payload->radio) + sizeof(tAniHdr))) { - PTT_TRACE(QDF_TRACE_LEVEL_ERROR, - "u16 overflow length %d %zu %zu", - length, - sizeof(payload->radio), - sizeof(tAniHdr)); - return; - } if (nla_len(tb[CLD80211_ATTR_DATA]) < (length + - sizeof(payload->radio) + - sizeof(tAniHdr))) { + sizeof(payload->radio))) { PTT_TRACE(VOS_TRACE_LEVEL_ERROR, "ATTR_DATA len check failed"); return; } |