From e4e3a14cf49bdd42821634cbc7ffedaa17b790cb Mon Sep 17 00:00:00 2001 From: Krishna Kumaar Natarajan Date: Fri, 1 Apr 2016 16:27:51 -0700 Subject: qcacld-3.0: Fix incorrect handling of additional IE in assoc response Fix incorrect handling of additional IE coming from userspace in assoc response. additonal_ielen field used for the logical checks and buffer manipulation does not contain correct value which might lead to incorrect behavior. Change-Id: I483696d1fa1a731e9afd0a4ea134900d81be7b43 CRs-Fixed: 998427 --- core/mac/src/pe/lim/lim_send_management_frames.c | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/core/mac/src/pe/lim/lim_send_management_frames.c b/core/mac/src/pe/lim/lim_send_management_frames.c index ef138b90b7d6..daa44fd0b6ee 100644 --- a/core/mac/src/pe/lim/lim_send_management_frames.c +++ b/core/mac/src/pe/lim/lim_send_management_frames.c @@ -1296,11 +1296,12 @@ lim_send_assoc_rsp_mgmt_frame(tpAniSirGlobal mac_ctx, bytes = sizeof(tSirMacMgmtHdr) + payload; if (assoc_req != NULL) { - addn_ie_len = (pe_session->addIeParams.assocRespDataLen != 0); + addn_ie_len = pe_session->addIeParams.assocRespDataLen; /* Nonzero length indicates Assoc rsp IE available */ - if (addn_ie_len <= WNI_CFG_ASSOC_RSP_ADDNIE_DATA_LEN - && (bytes + addn_ie_len) <= SIR_MAX_PACKET_SIZE) { + if (addn_ie_len > 0 && + addn_ie_len <= WNI_CFG_ASSOC_RSP_ADDNIE_DATA_LEN && + (bytes + addn_ie_len) <= SIR_MAX_PACKET_SIZE) { qdf_mem_copy(add_ie, pe_session->addIeParams.assocRespData_buff, pe_session->addIeParams.assocRespDataLen); -- cgit v1.2.3