From 0437618b179f99e7d55f652de33e4bdd18275da0 Mon Sep 17 00:00:00 2001
From: SaidiReddy Yenuga <saidir@codeaurora.org>
Date: Mon, 28 Nov 2016 14:35:06 +0530
Subject: qcacld-3.0: Validate station id

In function __hdd_softap_hard_start_xmit, station id is
not validated with max station count, this might lead to
a buffer overflow situation for array aStaInfo in SapCtx.

Validate station id with max sta count.

CRs-Fixed: 1093122
Change-Id: If9f59c5a7b76845bb7783a96453e595b5afa4f30
---
 core/hdd/src/wlan_hdd_softap_tx_rx.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/core/hdd/src/wlan_hdd_softap_tx_rx.c b/core/hdd/src/wlan_hdd_softap_tx_rx.c
index ea8c3c55ab55..ff08535ea10c 100644
--- a/core/hdd/src/wlan_hdd_softap_tx_rx.c
+++ b/core/hdd/src/wlan_hdd_softap_tx_rx.c
@@ -294,7 +294,7 @@ static int __hdd_softap_hard_start_xmit(struct sk_buff *skb,
 			goto drop_pkt;
 		}
 
-		if (STAId == HDD_WLAN_INVALID_STA_ID) {
+		if (STAId >= WLAN_MAX_STA_COUNT) {
 			QDF_TRACE(QDF_MODULE_ID_HDD_SAP_DATA,
 				  QDF_TRACE_LEVEL_WARN,
 				  "%s: Failed to find right station", __func__);
-- 
cgit v1.2.3