diff options
| author | Naveen Rawat <naveenrawat@codeaurora.org> | 2017-10-03 16:58:25 -0700 |
|---|---|---|
| committer | snandini <snandini@codeaurora.org> | 2017-10-04 19:05:50 -0700 |
| commit | 6e240410fcc8c8fef0495e7322308045d3baeba1 (patch) | |
| tree | 991dfd1407702dc4af013fef4d74e453016c64ff | |
| parent | 61b3004ec960f590dd7118ac587bdb44843d14d8 (diff) | |
qcacld-3.0: Check vdev_id against wma->max_bssid
Check vdev_id against wma->max_bssid in wma_mcc_vdev_tx_pause_evt_handler
to avoid bufer overflow.
Change-Id: Ie47a0ed2f7f27f13a01e1b2cb365fae66b41b1df
CRs-Fixed: 2120677
| -rw-r--r-- | core/wma/src/wma_data.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/core/wma/src/wma_data.c b/core/wma/src/wma_data.c index 30932e25592d..e8b3dad988bd 100644 --- a/core/wma/src/wma_data.c +++ b/core/wma/src/wma_data.c @@ -1629,7 +1629,8 @@ int wma_mcc_vdev_tx_pause_evt_handler(void *handle, uint8_t *event, * vdev_map = (1 << vdev_id) * So, host should unmap to ID */ - for (vdev_id = 0; vdev_map != 0; vdev_id++) { + for (vdev_id = 0; vdev_map != 0 && vdev_id < wma->max_bssid; + vdev_id++) { if (!(vdev_map & 0x1)) { /* No Vdev */ } else { |