diff options
| author | Arif Hussain <arifhussain@codeaurora.org> | 2016-10-25 18:34:21 -0700 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2016-10-29 17:23:49 -0700 |
| commit | 16f1dae19a16adeb267940d14078a1f4726489b6 (patch) | |
| tree | 1573315991f0be170e5674b2f58c2252e657e28b | |
| parent | c2bb440175aad18c0f504c3f746252b26ca5f320 (diff) | |
qcacld-3.0: Fix possible buffer overflow in sap_random_channel_sel
In function sap_random_channel_sel change final_lst array size from
WNI_CFG_VALID_CHANNEL_LIST_LEN (100) to QDF_MAX_NUM_CHAN (128) to
avoid possible buffer overflow, as sap_apply_rules function can return
rule_adjusted_cnt QDF_MAX_NUM_CHAN size.
Change-Id: I367dc54966fa57a7ef0195279953e31def06fd21
CRs-Fixed: 1082162
(cherry picked from commit bceffc9b2cfb622fbb44b5ec768fd7ebc6ecadb2)
| -rw-r--r-- | core/sap/src/sap_fsm.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/core/sap/src/sap_fsm.c b/core/sap/src/sap_fsm.c index 8e7d744fe91c..2a091dbbbfbd 100644 --- a/core/sap/src/sap_fsm.c +++ b/core/sap/src/sap_fsm.c @@ -1635,7 +1635,7 @@ static uint8_t sap_random_channel_sel(ptSapContext sap_ctx) /* ch list after invalidating channels leaking into NOL */ uint8_t *leakage_adjusted_lst; /* final list of channel from which random channel will be selected */ - uint8_t final_lst[WNI_CFG_VALID_CHANNEL_LIST_LEN] = {0}; + uint8_t final_lst[QDF_MAX_NUM_CHAN] = {0}; tAll5GChannelList *all_ch = &sap_ctx->SapAllChnlList; tHalHandle hal = CDS_GET_HAL_CB(sap_ctx->p_cds_gctx); tpAniSirGlobal mac_ctx; |