diff options
| author | Bala Venkatesh <bjavvaji@codeaurora.org> | 2017-10-18 13:08:38 +0530 |
|---|---|---|
| committer | snandini <snandini@codeaurora.org> | 2017-11-05 21:24:24 -0800 |
| commit | 67cfe475cb8ea3dfa86c68fca536b4ddb5168e9d (patch) | |
| tree | 3e253c451f5a05a9852723d606c12ff46fd7ce36 | |
| parent | 420b72e3160b76fb043b60271aebe63c33d496d0 (diff) | |
qcacld-2.0: Check vdev_id against wma->max_bssid
Check vdev_id against wma->max_bssid in wma_mcc_vdev_tx_pause_evt_handler
to avoid bufer overflow.
Change-Id: Ie47a0ed2f7f27f13a01e1b2cb365fae66b41b1df
CRs-Fixed: 2119404
| -rw-r--r-- | CORE/SERVICES/WMA/wma.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/CORE/SERVICES/WMA/wma.c b/CORE/SERVICES/WMA/wma.c index 9780e5874058..3349c81a68fd 100644 --- a/CORE/SERVICES/WMA/wma.c +++ b/CORE/SERVICES/WMA/wma.c @@ -34829,7 +34829,8 @@ static int wma_mcc_vdev_tx_pause_evt_handler(void *handle, u_int8_t *event, /* FW mapped vdev from ID * vdev_map = (1 << vdev_id) * So, host should unmap to ID */ - for (vdev_id = 0; vdev_map != 0; vdev_id++) + for (vdev_id = 0; vdev_map != 0 && vdev_id < wma->max_bssid; + vdev_id++) { if (!(vdev_map & 0x1)) { |