diff options
| author | Arif Hussain <arifhussain@codeaurora.org> | 2016-10-27 22:59:01 -0700 |
|---|---|---|
| committer | qcabuildsw <qcabuildsw@localhost> | 2016-10-29 17:34:02 -0700 |
| commit | 963331b5e2c7e72d6f71b57d8e8913334db0fbbd (patch) | |
| tree | ec3769e3bc8d4184e46b8d57c4cb8f0f01499620 | |
| parent | 1bd774c3c0bd9226d07f8328a50bdc089dc7fd69 (diff) | |
qcacld-3.0: Fix buffer overflow in __lim_process_roam_scan_offload_req
In validation code, change condition local_ie_len <= to always less than
QDF_ARRAY_SIZE(array) value, to avoid buffer overflow.
Change-Id: I9612ce6e922dd481747253b3b35d74060439c159
CRs-Fixed: 1082162
| -rw-r--r-- | core/mac/src/pe/lim/lim_process_sme_req_messages.c | 9 |
1 files changed, 5 insertions, 4 deletions
diff --git a/core/mac/src/pe/lim/lim_process_sme_req_messages.c b/core/mac/src/pe/lim/lim_process_sme_req_messages.c index 9bf72ec16e1f..ace88d8a89d0 100644 --- a/core/mac/src/pe/lim/lim_process_sme_req_messages.c +++ b/core/mac/src/pe/lim/lim_process_sme_req_messages.c @@ -4156,16 +4156,17 @@ static void __lim_process_roam_scan_offload_req(tpAniSirGlobal mac_ctx, local_ie_buf = qdf_mem_malloc(MAX_DEFAULT_SCAN_IE_LEN); if (!local_ie_buf) { - lim_log(mac_ctx, LOGE, FL("Mem Alloc failed for local_ie_buf")); + lim_log(mac_ctx, LOGE, + FL("Mem Alloc failed for local_ie_buf")); return; } local_ie_len = req_buffer->assoc_ie.length; /* Update ext cap IE if present */ if (local_ie_len && - !lim_update_ext_cap_ie(mac_ctx, req_buffer->assoc_ie.addIEdata, - local_ie_buf, &local_ie_len)) { - if (local_ie_len <= + !lim_update_ext_cap_ie(mac_ctx, req_buffer->assoc_ie.addIEdata, + local_ie_buf, &local_ie_len)) { + if (local_ie_len < QDF_ARRAY_SIZE(req_buffer->assoc_ie.addIEdata)) { req_buffer->assoc_ie.length = local_ie_len; qdf_mem_copy(req_buffer->assoc_ie.addIEdata, |