From bfc6d488802ac3e015efe8bc0edff0c44ac8fa64 Mon Sep 17 00:00:00 2001 From: Hong Shi Date: Mon, 14 Nov 2016 14:08:03 +0800 Subject: qcacld-3.0: Fix potential crash when setting monitor channel qcacld-2.0 to qcacld-3.0 propagation The tCsrRoamProfile memory is not initialized to 0 properly. For the supported_rates field, it contains a rates array with max size 12 and an integer field numRates which is the actual length of the rates array. If numRates is not initialized properly and value is unexpected. it may cause memory access violation error. CRs-Fixed: 1084846 Change-Id: Ic5b1a13356e835a1186c53768a1d8ab416c9365c --- core/hdd/src/wlan_hdd_wext.c | 1 + 1 file changed, 1 insertion(+) diff --git a/core/hdd/src/wlan_hdd_wext.c b/core/hdd/src/wlan_hdd_wext.c index 8a8e2ebec8dc..591ff4032f75 100644 --- a/core/hdd/src/wlan_hdd_wext.c +++ b/core/hdd/src/wlan_hdd_wext.c @@ -9812,6 +9812,7 @@ static int wlan_hdd_set_mon_chan(hdd_adapter_t *adapter, uint32_t chan, } hdd_info("Set monitor mode Channel %d", chan); + qdf_mem_zero(&roam_profile, sizeof(roam_profile)); roam_profile.ChannelInfo.ChannelList = &ch_info->channel; roam_profile.ChannelInfo.numOfChannels = 1; roam_profile.phyMode = ch_info->phy_mode; -- cgit v1.2.3