diff options
| author | Padma, Santhosh Kumar <skpadma@codeaurora.org> | 2016-08-08 19:58:49 +0530 |
|---|---|---|
| committer | Nishank Aggarwal <naggar@codeaurora.org> | 2016-09-16 21:06:36 +0530 |
| commit | faaa7bd8e2765fe5796d5500969ccde4eed7c326 (patch) | |
| tree | c6aafa8dacdfaff8146b9c27a700b8c441682d51 | |
| parent | dcba34f1c149f5262125335395a9e0166dfafd0b (diff) | |
qcacld-3.0: Fix buffer overflow
qcacld-2.0 to qcacld-3.0 propagation
In limInitPeerIdxpool, driver initializes gLimAssocStaLimit/
gLimIbssStaLimit entries of peer index pool. But there is a chance
of allocating less memory for peer index pool in peCreateSession
which can overwrite adjacent memory locations as maxStation can be
different from gLimAssocStaLimit/gLimIbssStaLimit. Fix this by
initializing maxStation entries.
Change-Id: I915e67fe7a15ebe622273af971d8a88ad78585cf
CRs-Fixed: 1025378
| -rw-r--r-- | core/mac/src/pe/lim/lim_aid_mgmt.c | 28 |
1 files changed, 11 insertions, 17 deletions
diff --git a/core/mac/src/pe/lim/lim_aid_mgmt.c b/core/mac/src/pe/lim/lim_aid_mgmt.c index f99a8ae25197..c1c0b48398d3 100644 --- a/core/mac/src/pe/lim/lim_aid_mgmt.c +++ b/core/mac/src/pe/lim/lim_aid_mgmt.c @@ -50,37 +50,32 @@ #define LIM_START_PEER_IDX 1 /** - * lim_init_peer_idxpool() + * lim_init_peer_idxpool() -- initializes peer index pool + * @pMac: mac context + * @pSessionEntry: session entry * - ***FUNCTION: * This function is called while starting a BSS at AP * to initialize AID pool. This may also be called while * starting/joining an IBSS if 'Association' is allowed * in IBSS. * - ***LOGIC: - * - ***ASSUMPTIONS: - * NA - * - ***NOTE: - * NA - * - * @param pMac - Pointer to Global MAC structure - * @return None + * Return: None */ void lim_init_peer_idxpool(tpAniSirGlobal pMac, tpPESession pSessionEntry) { uint8_t i; - uint8_t maxAssocSta = pMac->lim.gLimAssocStaLimit; + uint8_t maxAssocSta = pMac->lim.maxStation; pSessionEntry->gpLimPeerIdxpool[0] = 0; #ifdef FEATURE_WLAN_TDLS - /* In station role, DPH_STA_HASH_INDEX_PEER (index 1) is reserved for peer */ - /* station index corresponding to AP. Avoid choosing that index and get index */ - /* starting from (DPH_STA_HASH_INDEX_PEER + 1) (index 2) for TDLS stations; */ + /* + * In station role, DPH_STA_HASH_INDEX_PEER (index 1) is reserved + * for peer station index corresponding to AP. Avoid choosing that index + * and get index starting from (DPH_STA_HASH_INDEX_PEER + 1) + * (index 2) for TDLS stations; + */ if (LIM_IS_STA_ROLE(pSessionEntry)) { pSessionEntry->freePeerIdxHead = DPH_STA_HASH_INDEX_PEER + 1; } else @@ -88,7 +83,6 @@ void lim_init_peer_idxpool(tpAniSirGlobal pMac, tpPESession pSessionEntry) #ifdef QCA_IBSS_SUPPORT if (LIM_IS_IBSS_ROLE(pSessionEntry)) { pSessionEntry->freePeerIdxHead = LIM_START_PEER_IDX; - maxAssocSta = pMac->lim.gLimIbssStaLimit; } else #endif { |