Browse Source

qcacmn: Use the right index while accessing ipv6 array

Zero comp value if changed; would be 1 to 8. When accessing
ipv6 array, the access can go out of bounds if value is 8 since
the bytes array is of size 16 (0 to 15). Fix that.

Change-Id: I38eb1d3be2840bfbb5fdc9c72606ce51e29cb0ce
CRs-Fixed: 2196076
Amar Singhal 7 years ago
parent
commit
0894f015d8
1 changed files with 2 additions and 2 deletions
  1. 2 2
      qdf/src/qdf_types.c

+ 2 - 2
qdf/src/qdf_types.c

@@ -512,8 +512,8 @@ QDF_STATUS qdf_ipv6_parse(const char *ipv6_str, struct qdf_ipv6_addr *out_addr)
 	/* shift lower hextets if zero compressed */
 	if (zero_comp >= 0) {
 		uint8_t shift = QDF_IPV6_ADDR_HEXTET_COUNT - hextets_found;
-		void *to = &addr.bytes[(zero_comp + shift) * 2];
-		void *from = &addr.bytes[zero_comp * 2];
+		void *to = &addr.bytes[((zero_comp - 1) + shift) *2];
+		void *from = &addr.bytes[(zero_comp - 1) *2];
 
 		qdf_mem_move(to, from, (hextets_found - zero_comp) * 2);
 		qdf_mem_set(from, shift * 2, 0);