diff options
| author | Sushant Kaushik <skaushik@qti.qualcomm.com> | 2015-06-18 13:32:27 +0530 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2015-07-01 08:26:47 -0700 |
| commit | 6117df5c4a1a48ab88aaa34aa84f3d578cbbae1c (patch) | |
| tree | 0942e8e15551bfb3ec979a95b92437d6308f6048 /CORE/MAC/src | |
| parent | 42aed487faaf3147f9e96408601a3e7fba84cc5a (diff) | |
wlan: Fix static analysis error in limProcessTdls.c
prima to qcacld-2.0 propagation
Currently while populating 11a and 11b rates, there is
no bound check for rateset array. This can result in buffer
overflow. As a part of fix add bound check to avoid any
buffer overflow for the rateset.
CRs-fixed: 798054
Change-Id: Ib42f5de642ad54d5c2a1ccdab37d88928b98af01
Diffstat (limited to 'CORE/MAC/src')
| -rw-r--r-- | CORE/MAC/src/pe/lim/limProcessTdls.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/CORE/MAC/src/pe/lim/limProcessTdls.c b/CORE/MAC/src/pe/lim/limProcessTdls.c index a87584910b57..bcfd34429653 100644 --- a/CORE/MAC/src/pe/lim/limProcessTdls.c +++ b/CORE/MAC/src/pe/lim/limProcessTdls.c @@ -2130,15 +2130,15 @@ limTdlsPopulateMatchingRateSet(tpAniSirGlobal pMac, if ((tempRateSet2.rate[i] & 0x7F) == (tempRateSet.rate[j] & 0x7F)) { -#ifdef FEATURE_WLAN_NON_INTEGRATED_SOC - if ((bRateIndex > HAL_NUM_11B_RATES) || (aRateIndex > HAL_NUM_11A_RATES)) + + if ((bRateIndex > SIR_NUM_11B_RATES) || (aRateIndex > SIR_NUM_11A_RATES)) { limLog(pMac, LOGE, FL("Invalid number of rates (11b->%d, 11a->%d)"), bRateIndex, aRateIndex); return eSIR_FAILURE; } -#endif + if (sirIsArate(tempRateSet2.rate[i] & 0x7f)) { isArate=1; if (aRateIndex < SIR_NUM_11A_RATES) |