瀏覽代碼

qcacld-3.0: Fix possible buffer overflow in sap_random_channel_sel

In function sap_random_channel_sel change final_lst  array size from
WNI_CFG_VALID_CHANNEL_LIST_LEN (100) to QDF_MAX_NUM_CHAN (128) to
avoid possible buffer overflow, as sap_apply_rules function can return
rule_adjusted_cnt QDF_MAX_NUM_CHAN size.

Change-Id: I367dc54966fa57a7ef0195279953e31def06fd21
CRs-Fixed: 1082162
(cherry picked from commit bceffc9b2cfb622fbb44b5ec768fd7ebc6ecadb2)
Arif Hussain 8 年之前
父節點
當前提交
16f1dae19a
共有 1 個文件被更改,包括 1 次插入1 次删除
  1. 1 1
      core/sap/src/sap_fsm.c

+ 1 - 1
core/sap/src/sap_fsm.c

@@ -1635,7 +1635,7 @@ static uint8_t sap_random_channel_sel(ptSapContext sap_ctx)
 	/* ch list after invalidating channels leaking into NOL */
 	uint8_t *leakage_adjusted_lst;
 	/* final list of channel from which random channel will be selected */
-	uint8_t final_lst[WNI_CFG_VALID_CHANNEL_LIST_LEN] = {0};
+	uint8_t final_lst[QDF_MAX_NUM_CHAN] = {0};
 	tAll5GChannelList *all_ch = &sap_ctx->SapAllChnlList;
 	tHalHandle hal = CDS_GET_HAL_CB(sap_ctx->p_cds_gctx);
 	tpAniSirGlobal mac_ctx;