From afd543891bbf33c52cdbbc9079aa1b3043706778 Mon Sep 17 00:00:00 2001 From: yeshwanth sriram guntuka Date: Fri, 7 Apr 2017 16:30:34 +0530 Subject: qcacld-2.0: Fix out of bounds bug in limProcessMessages uMacPostCtrlMsg allocates memory of size tSirSmeScanAbortReq for tSirMbMsg structure for scan abort msg that is posted to mc thread. In limProcessMessages, we typecast the bodyptr to tSirMbMsg and use data variable which results in slab out of bounds bug. Fix is to typecast the bodyptr to tSirSmeScanAbortReq in limProcessMessages. Change-Id: Iabeeabcba64ccc30895f57cbe40d969f1a9e6dca CRs-Fixed: 2031160 --- CORE/MAC/src/pe/lim/limProcessMessageQueue.c | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/CORE/MAC/src/pe/lim/limProcessMessageQueue.c b/CORE/MAC/src/pe/lim/limProcessMessageQueue.c index 641c525708cc..fabc36820500 100644 --- a/CORE/MAC/src/pe/lim/limProcessMessageQueue.c +++ b/CORE/MAC/src/pe/lim/limProcessMessageQueue.c @@ -1389,12 +1389,10 @@ limProcessMessages(tpAniSirGlobal pMac, tpSirMsgQ limMsg) break; case eWNI_SME_SCAN_ABORT_IND: { - tSirMbMsg *pMsg = limMsg->bodyptr; - tANI_U8 sessionId; + tSirSmeScanAbortReq *pMsg = (tSirSmeScanAbortReq *)limMsg->bodyptr; if (pMsg) { - sessionId = (tANI_U8) pMsg->data[0]; - limProcessAbortScanInd(pMac, sessionId); + limProcessAbortScanInd(pMac, pMsg->sessionId); vos_mem_free((v_VOID_t *)limMsg->bodyptr); limMsg->bodyptr = NULL; } -- cgit v1.2.3