diff options
| author | Will Huang <wilhuang@codeaurora.org> | 2018-08-29 15:43:24 +0800 |
|---|---|---|
| committer | nshrivas <nshrivas@codeaurora.org> | 2018-09-05 10:35:26 -0700 |
| commit | 53101065a50608fa68fe473b9cb87f8c373f9619 (patch) | |
| tree | 6cdd05704f14e36cf8c48195432481ae11b61f21 /tools/perf/scripts/python | |
| parent | 37e677d442d47692e0f6017988167dbfdd7e82f1 (diff) | |
qcacld-3.0: Fix possible roam_synch_frame_event handler OOB
The length attributes for all message frames are retrieved from
param_buf->fixed_param rather than using the correct TLV length values.
This can result in multiple buffer overreads due to the fact that the
param_buf->fixed_param lengths are never properly checked against the
original TLV buffer.
Add check param_buf->fixed_param lengths against the TLV buffer to
prevent OOB happen.
Change-Id: Ib6e2c847b9a2cc7bfe1233eb1f8214be75f21850
CRs-Fixed: 2304631
Diffstat (limited to 'tools/perf/scripts/python')
0 files changed, 0 insertions, 0 deletions