diff options
| author | Naveen Rawat <naveenrawat@codeaurora.org> | 2016-06-27 15:29:16 -0700 |
|---|---|---|
| committer | Nandini Suresh <snandini@codeaurora.org> | 2016-06-30 11:06:13 -0700 |
| commit | afa1553e878cbf2b710070711bca487691e555e6 (patch) | |
| tree | 107ff2a3e553a36a41f7257d6e0bae97060e6732 | |
| parent | d4b56dadebb0350cbbf436db9a84c69dc54104e1 (diff) | |
qcacld-3.0: Fix out of bound access in convert_qos_mapset_frame
In function convert_qos_mapset_frame, restrict dscp_exceptions array access
index to size of array
Change-Id: Ieb153e4d263fbc1455b41bec71ec78b7c49558fc
CRs-Fixed: 1034255
| -rw-r--r-- | core/mac/src/sys/legacy/src/utils/src/utils_parser.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/core/mac/src/sys/legacy/src/utils/src/utils_parser.c b/core/mac/src/sys/legacy/src/utils/src/utils_parser.c index 093e40430ff0..e300de33aee2 100644 --- a/core/mac/src/sys/legacy/src/utils/src/utils_parser.c +++ b/core/mac/src/sys/legacy/src/utils/src/utils_parser.c @@ -708,8 +708,15 @@ void convert_qos_mapset_frame(tpAniSirGlobal pMac, tSirQosMapSet *Qos, tDot11fIEQosMapSet *dot11fIE) { uint8_t i, j = 0; + uint8_t qos_dscp_sz, dot11_dscp_sz; + + qos_dscp_sz = (sizeof(Qos->dscp_exceptions)/2); + dot11_dscp_sz = sizeof(dot11fIE->dscp_exceptions); Qos->num_dscp_exceptions = (dot11fIE->num_dscp_exceptions - 16) / 2; - for (i = 0; i < Qos->num_dscp_exceptions; i++) { + for (i = 0; + i < Qos->num_dscp_exceptions && + i < qos_dscp_sz && j < dot11_dscp_sz; + i++) { Qos->dscp_exceptions[i][0] = dot11fIE->dscp_exceptions[j]; j++; Qos->dscp_exceptions[i][1] = dot11fIE->dscp_exceptions[j]; |