diff options
| author | Krishna Kumaar Natarajan <kknatara@codeaurora.org> | 2016-04-01 16:27:51 -0700 |
|---|---|---|
| committer | Akash Patel <akashp@codeaurora.org> | 2016-05-13 16:20:43 -0700 |
| commit | e4e3a14cf49bdd42821634cbc7ffedaa17b790cb (patch) | |
| tree | c184707587afdd22fbc8db5d0bd1a891fc82bd3b | |
| parent | fa598f95af393dd16b2a4d2347770bfd89f0912d (diff) | |
qcacld-3.0: Fix incorrect handling of additional IE in assoc response
Fix incorrect handling of additional IE coming from userspace in assoc
response. additonal_ielen field used for the logical checks and buffer
manipulation does not contain correct value which might lead to incorrect
behavior.
Change-Id: I483696d1fa1a731e9afd0a4ea134900d81be7b43
CRs-Fixed: 998427
| -rw-r--r-- | core/mac/src/pe/lim/lim_send_management_frames.c | 7 |
1 files changed, 4 insertions, 3 deletions
diff --git a/core/mac/src/pe/lim/lim_send_management_frames.c b/core/mac/src/pe/lim/lim_send_management_frames.c index ef138b90b7d6..daa44fd0b6ee 100644 --- a/core/mac/src/pe/lim/lim_send_management_frames.c +++ b/core/mac/src/pe/lim/lim_send_management_frames.c @@ -1296,11 +1296,12 @@ lim_send_assoc_rsp_mgmt_frame(tpAniSirGlobal mac_ctx, bytes = sizeof(tSirMacMgmtHdr) + payload; if (assoc_req != NULL) { - addn_ie_len = (pe_session->addIeParams.assocRespDataLen != 0); + addn_ie_len = pe_session->addIeParams.assocRespDataLen; /* Nonzero length indicates Assoc rsp IE available */ - if (addn_ie_len <= WNI_CFG_ASSOC_RSP_ADDNIE_DATA_LEN - && (bytes + addn_ie_len) <= SIR_MAX_PACKET_SIZE) { + if (addn_ie_len > 0 && + addn_ie_len <= WNI_CFG_ASSOC_RSP_ADDNIE_DATA_LEN && + (bytes + addn_ie_len) <= SIR_MAX_PACKET_SIZE) { qdf_mem_copy(add_ie, pe_session->addIeParams.assocRespData_buff, pe_session->addIeParams.assocRespDataLen); |