diff options
| author | yeshwanth sriram guntuka <ysriramg@codeaurora.org> | 2017-07-26 11:09:20 +0530 |
|---|---|---|
| committer | snandini <snandini@codeaurora.org> | 2017-08-10 03:29:10 -0700 |
| commit | df166cf41f61168351a187b9cb97cb1526560c97 (patch) | |
| tree | bf1b94696248366a4d54aa11c1da47bc99fa9c0e | |
| parent | 9358b9e58f1281f59f36df320b8fb3590e28d06c (diff) | |
qcacld-3.0: Fix kernel memory corruption
Buffer overflow in ConvertQosMapsetFrame function
when num_dscp_exceptions value is less than 16.
Fix is to return from function if num_dscp_exceptions
is less than 16.
Change-Id: I2fcce60b7fe5e988348cee786e9a4d493d9512fe
CRs-Fixed: 2086305
| -rw-r--r-- | core/mac/src/sys/legacy/src/utils/src/utils_parser.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/core/mac/src/sys/legacy/src/utils/src/utils_parser.c b/core/mac/src/sys/legacy/src/utils/src/utils_parser.c index 5c0bb3d6dd3d..27835d215af2 100644 --- a/core/mac/src/sys/legacy/src/utils/src/utils_parser.c +++ b/core/mac/src/sys/legacy/src/utils/src/utils_parser.c @@ -712,6 +712,8 @@ void convert_qos_mapset_frame(tpAniSirGlobal pMac, tSirQosMapSet *Qos, dot11_dscp_sz = sizeof(dot11fIE->dscp_exceptions); if (dot11fIE->num_dscp_exceptions > QOS_MAP_LEN_MAX) dot11fIE->num_dscp_exceptions = QOS_MAP_LEN_MAX; + if (dot11fIE->num_dscp_exceptions < QOS_MAP_LEN_MIN) + return; Qos->num_dscp_exceptions = (dot11fIE->num_dscp_exceptions - QOS_MAP_LEN_MIN) / 2; |