diff options
| author | Service qcabuildsw <qcabuildsw@localhost> | 2016-11-29 15:47:53 -0800 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2016-11-29 15:47:53 -0800 |
| commit | dd0253766fea7692cef03f823c9ba8a3438bc6c8 (patch) | |
| tree | 5b74bfed77f8aaf634bc3dc9c5937c9e350e9886 | |
| parent | 121b32f807ff3df4b527d94cf032b4238960f396 (diff) | |
| parent | 65134d95b8406c4ceaa41aa2b0b5786c6ec4f66c (diff) | |
Merge "qcacld-3.0: Fix buf_len check in lim_send_sme_wm_status_change_ntf" into wlan-cld3.driver.lnx.1.1-dev
| -rw-r--r-- | core/mac/src/pe/lim/lim_send_sme_rsp_messages.c | 16 |
1 files changed, 14 insertions, 2 deletions
diff --git a/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c b/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c index df3a6a8e40b8..b1f5a45b8fdc 100644 --- a/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c +++ b/core/mac/src/pe/lim/lim_send_sme_rsp_messages.c @@ -1463,6 +1463,7 @@ lim_send_sme_wm_status_change_ntf(tpAniSirGlobal mac_ctx, { tSirMsgQ msg; tSirSmeWmStatusChangeNtf *wm_status_change_ntf; + uint32_t max_info_len; wm_status_change_ntf = qdf_mem_malloc(sizeof(tSirSmeWmStatusChangeNtf)); if (NULL == wm_status_change_ntf) { @@ -1476,6 +1477,18 @@ lim_send_sme_wm_status_change_ntf(tpAniSirGlobal mac_ctx, msg.bodyptr = wm_status_change_ntf; switch (status_change_code) { + case eSIR_SME_AP_CAPS_CHANGED: + max_info_len = sizeof(tSirSmeApNewCaps); + break; + case eSIR_SME_JOINED_NEW_BSS: + max_info_len = sizeof(tSirSmeNewBssInfo); + break; + default: + max_info_len = sizeof(wm_status_change_ntf->statusChangeInfo); + break; + } + + switch (status_change_code) { case eSIR_SME_RADAR_DETECTED: break; default: @@ -1484,8 +1497,7 @@ lim_send_sme_wm_status_change_ntf(tpAniSirGlobal mac_ctx, wm_status_change_ntf->statusChangeCode = status_change_code; wm_status_change_ntf->length = sizeof(tSirSmeWmStatusChangeNtf); wm_status_change_ntf->sessionId = session_id; - if (sizeof(wm_status_change_ntf->statusChangeInfo) >= - info_len) { + if (info_len <= max_info_len && status_change_info) { qdf_mem_copy( (uint8_t *) &wm_status_change_ntf->statusChangeInfo, (uint8_t *) status_change_info, info_len); |