Browse Source

qcacld-3.0: Allocate memory of size matching its variable type

dp_stats is of type struct dp_tx_rx_stats, but memory is allocated of type
struct hdd_tx_rx_stats. Both structs are of different size and
sizeof(struct hdd_tx_rx_stats) is lesser than sizeof(struct dp_tx_rx_stats)
which is causing access out of bounds.

Fix this issue by allocating memory of size matching its type.

Change-Id: Iccc04c38fb64d65f3483ae9b128dc316e7036ec5
CRs-Fixed: 3290287
Srinivas Girigowda 2 years ago
parent
commit
21f3233946
2 changed files with 2 additions and 2 deletions
  1. 1 1
      core/hdd/src/wlan_hdd_sysfs_stats.c
  2. 1 1
      core/hdd/src/wlan_hdd_wext.c

+ 1 - 1
core/hdd/src/wlan_hdd_sysfs_stats.c

@@ -57,7 +57,7 @@ static void hdd_sysfs_get_stats(struct hdd_adapter *adapter, ssize_t *length,
 	if (!vdev)
 		return;
 
-	dp_stats = qdf_mem_malloc(sizeof(*stats));
+	dp_stats = qdf_mem_malloc(sizeof(*dp_stats));
 	if (!dp_stats) {
 		hdd_objmgr_put_vdev_by_user(vdev, WLAN_DP_ID);
 		return;

+ 1 - 1
core/hdd/src/wlan_hdd_wext.c

@@ -2807,7 +2807,7 @@ void hdd_wlan_get_stats(struct hdd_adapter *adapter, uint16_t *length,
 	if (!vdev)
 		return;
 
-	dp_stats = qdf_mem_malloc(sizeof(*stats));
+	dp_stats = qdf_mem_malloc(sizeof(*dp_stats));
 	if (!dp_stats) {
 		hdd_objmgr_put_vdev_by_user(vdev, WLAN_DP_ID);
 		return;