diff options
| author | yeshwanth sriram guntuka <ysriramg@codeaurora.org> | 2017-04-07 16:30:34 +0530 |
|---|---|---|
| committer | yeshwanth sriram guntuka <ysriramg@codeaurora.org> | 2017-04-14 14:02:38 +0530 |
| commit | afd543891bbf33c52cdbbc9079aa1b3043706778 (patch) | |
| tree | 2a0eb629e0307a8eef8f611d7080578e20f59c04 | |
| parent | 08290584a807fad4e78c6acff954b78cd3d88932 (diff) | |
qcacld-2.0: Fix out of bounds bug in limProcessMessages
uMacPostCtrlMsg allocates memory of size tSirSmeScanAbortReq
for tSirMbMsg structure for scan abort msg that is posted to
mc thread. In limProcessMessages, we typecast the bodyptr to
tSirMbMsg and use data variable which results in slab out of
bounds bug.
Fix is to typecast the bodyptr to tSirSmeScanAbortReq
in limProcessMessages.
Change-Id: Iabeeabcba64ccc30895f57cbe40d969f1a9e6dca
CRs-Fixed: 2031160
| -rw-r--r-- | CORE/MAC/src/pe/lim/limProcessMessageQueue.c | 6 |
1 files changed, 2 insertions, 4 deletions
diff --git a/CORE/MAC/src/pe/lim/limProcessMessageQueue.c b/CORE/MAC/src/pe/lim/limProcessMessageQueue.c index 641c525708cc..fabc36820500 100644 --- a/CORE/MAC/src/pe/lim/limProcessMessageQueue.c +++ b/CORE/MAC/src/pe/lim/limProcessMessageQueue.c @@ -1389,12 +1389,10 @@ limProcessMessages(tpAniSirGlobal pMac, tpSirMsgQ limMsg) break; case eWNI_SME_SCAN_ABORT_IND: { - tSirMbMsg *pMsg = limMsg->bodyptr; - tANI_U8 sessionId; + tSirSmeScanAbortReq *pMsg = (tSirSmeScanAbortReq *)limMsg->bodyptr; if (pMsg) { - sessionId = (tANI_U8) pMsg->data[0]; - limProcessAbortScanInd(pMac, sessionId); + limProcessAbortScanInd(pMac, pMsg->sessionId); vos_mem_free((v_VOID_t *)limMsg->bodyptr); limMsg->bodyptr = NULL; } |