diff options
| author | Naveen Rawat <naveenrawat@codeaurora.org> | 2016-11-17 11:49:17 -0800 |
|---|---|---|
| committer | qcabuildsw <qcabuildsw@localhost> | 2016-11-29 16:06:55 -0800 |
| commit | 602fbd3eb67ada0e0315b61f5e4e804031cf8954 (patch) | |
| tree | 83c6e78c57615ba92cf8095f5328d93c8c5d5d82 | |
| parent | 51ecba96735bddb9a9ac9b2a0416e707bd395b09 (diff) | |
qcacld-3.0: Check num_chn before accessing channel list array
In function csr_issue_11d_scan, num channels is fetched from mac_ctx
before being used to access channel list. Check it against
WNI_CFG_VALID_CHANNEL_LIST_LEN before accessing channel list.
Change-Id: I4ef21ca03e1227801aaed2d5598aba7b91fdf8d3
CRs-Fixed: 1091486
| -rw-r--r-- | core/sme/src/csr/csr_api_scan.c | 24 |
1 files changed, 15 insertions, 9 deletions
diff --git a/core/sme/src/csr/csr_api_scan.c b/core/sme/src/csr/csr_api_scan.c index ab595ed1707c..a7149c92668b 100644 --- a/core/sme/src/csr/csr_api_scan.c +++ b/core/sme/src/csr/csr_api_scan.c @@ -377,8 +377,8 @@ csr_issue_11d_scan(tpAniSirGlobal mac_ctx, tSmeCmd *scan_cmd, QDF_STATUS status; tSmeCmd *scan_11d_cmd = NULL; tCsrScanRequest tmp_rq; - tCsrChannelInfo *pChnInfo = &tmp_rq.ChannelInfo; - uint32_t numChn = mac_ctx->scan.base_channels.numChannels; + tCsrChannelInfo *chn_info = &tmp_rq.ChannelInfo; + uint32_t num_chn = mac_ctx->scan.base_channels.numChannels; tCsrRoamSession *csr_session = CSR_GET_SESSION(mac_ctx, session_id); if (csr_session == NULL) { @@ -388,6 +388,12 @@ csr_issue_11d_scan(tpAniSirGlobal mac_ctx, tSmeCmd *scan_cmd, return QDF_STATUS_E_FAILURE; } + if (num_chn > WNI_CFG_VALID_CHANNEL_LIST_LEN) { + sms_log(mac_ctx, LOGE, FL("invalid number of channels: %d"), + num_chn); + return QDF_STATUS_E_FAILURE; + } + if (!(((false == mac_ctx->first_scan_done) && (eCSR_SCAN_REQUEST_11D_SCAN != scan_req->requestType)) #ifdef SOFTAP_CHANNEL_RANGE @@ -404,15 +410,15 @@ csr_issue_11d_scan(tpAniSirGlobal mac_ctx, tSmeCmd *scan_cmd, } qdf_mem_set(&scan_11d_cmd->u.scanCmd, sizeof(tScanCmd), 0); - pChnInfo->ChannelList = qdf_mem_malloc(numChn); - if (NULL == pChnInfo->ChannelList) { + chn_info->ChannelList = qdf_mem_malloc(num_chn); + if (NULL == chn_info->ChannelList) { sms_log(mac_ctx, LOGE, FL("Failed to allocate memory")); return QDF_STATUS_E_NOMEM; } - qdf_mem_copy(pChnInfo->ChannelList, - mac_ctx->scan.base_channels.channelList, numChn); + qdf_mem_copy(chn_info->ChannelList, + mac_ctx->scan.base_channels.channelList, num_chn); - pChnInfo->numOfChannels = (uint8_t) numChn; + chn_info->numOfChannels = (uint8_t) num_chn; scan_11d_cmd->command = eSmeCommandScan; scan_11d_cmd->u.scanCmd.callback = mac_ctx->scan.callback11dScanDone; scan_11d_cmd->u.scanCmd.pContext = NULL; @@ -457,8 +463,8 @@ csr_issue_11d_scan(tpAniSirGlobal mac_ctx, tSmeCmd *scan_cmd, status = csr_scan_copy_request(mac_ctx, &scan_11d_cmd->u.scanCmd.u.scanRequest, &tmp_rq); /* Free the channel list */ - qdf_mem_free(pChnInfo->ChannelList); - pChnInfo->ChannelList = NULL; + qdf_mem_free(chn_info->ChannelList); + chn_info->ChannelList = NULL; if (!QDF_IS_STATUS_SUCCESS(status)) { sms_log(mac_ctx, LOGE, FL("csr_scan_copy_request failed")); return QDF_STATUS_E_FAILURE; |