diff options
| author | Hong Shi <hongsh@codeaurora.org> | 2016-11-02 11:25:17 +0800 |
|---|---|---|
| committer | Anjaneedevi Kapparapu <akappa@codeaurora.org> | 2016-11-11 19:43:43 +0530 |
| commit | f28f31e407975b9878ba136dec8d90dacb7cd69f (patch) | |
| tree | 37ad24e1b4c755953c64d44922f7082d372f6ec1 | |
| parent | 471dae0efa04dc3b6b8386831857dc4244862f86 (diff) | |
qcacld-2.0: Fix potential crash when setting monitor channel
The tCsrRoamProfile memory is not initialized to 0 properly. For the
supported_rates field, it contains a rates array with max size 12
and an integer field numRates which is the actual length of the rates
array. If numRates is not initialized properly and value is unexpected.
it may cause memory access violation error.
CRs-Fixed: 1084846
Change-Id: Ic5b1a13356e835a1186c53768a1d8ab416c9365c
| -rw-r--r-- | CORE/HDD/src/wlan_hdd_wext.c | 2 |
1 files changed, 2 insertions, 0 deletions
diff --git a/CORE/HDD/src/wlan_hdd_wext.c b/CORE/HDD/src/wlan_hdd_wext.c index eab72290912a..0ac7f4c1f410 100644 --- a/CORE/HDD/src/wlan_hdd_wext.c +++ b/CORE/HDD/src/wlan_hdd_wext.c @@ -11045,6 +11045,8 @@ static int __iw_set_two_ints_getnone(struct net_device *dev, hddLog(LOG1, "Set monitor mode Channel %d", value[1]); hdd_select_cbmode(pAdapter, value[1], &vht_channel_width); + + vos_mem_zero(&roam_profile, sizeof(roam_profile)); roam_profile.ChannelInfo.ChannelList = &ch_info->channel; roam_profile.ChannelInfo.numOfChannels = 1; roam_profile.vht_channel_width = ch_info->channel_width; |