diff options
| author | Manjeet Singh <manjee@codeaurora.org> | 2016-10-27 15:58:01 +0530 |
|---|---|---|
| committer | qcabuildsw <qcabuildsw@localhost> | 2016-11-09 02:00:08 -0800 |
| commit | 8e7744c793dbc3961cd4671937f6cff684643318 (patch) | |
| tree | c62f5ce209aed87f297bb5405ef023344cdd4b93 | |
| parent | 0749392208cc344c8918772e11321417b28d2843 (diff) | |
qcacld-3.0: Validate regulatory channels
In function hdd_process_regulatory_data, array reg_channels is limited
by enum value NUM_CHANNELS. But there is no check on the index
to the reg_channels. This can lead to a buffer overflow situation.
Prevent buffer overflow for reg_channels by checking index
against NUM_CHANNELS.
Change-Id: I6050e6616e9bd6365943d2aaf8fbdb53a92f17d0
CRs-Fixed: 1083028
| -rw-r--r-- | core/hdd/src/wlan_hdd_regulatory.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/core/hdd/src/wlan_hdd_regulatory.c b/core/hdd/src/wlan_hdd_regulatory.c index daf29b519a44..daea66d98e1b 100644 --- a/core/hdd/src/wlan_hdd_regulatory.c +++ b/core/hdd/src/wlan_hdd_regulatory.c @@ -387,7 +387,8 @@ static void hdd_process_regulatory_data(hdd_context_t *hdd_ctx, continue; for (chan_num = 0; - chan_num < wiphy->bands[band_num]->n_channels; + chan_num < wiphy->bands[band_num]->n_channels && + chan_enum < NUM_CHANNELS; chan_num++) { wiphy_chan = |