Procházet zdrojové kódy

qcacld-3.0: Fix kernel memory corruption

Buffer overflow in ConvertQosMapsetFrame function
when num_dscp_exceptions value is less than 16.

Fix is to return from function if num_dscp_exceptions
is less than 16.

Change-Id: I2fcce60b7fe5e988348cee786e9a4d493d9512fe
CRs-Fixed: 2086305
yeshwanth sriram guntuka před 7 roky
rodič
revize
2413063a04

+ 2 - 0
core/mac/src/sys/legacy/src/utils/src/utils_parser.c

@@ -712,6 +712,8 @@ void convert_qos_mapset_frame(tpAniSirGlobal pMac, tSirQosMapSet *Qos,
 	dot11_dscp_sz = sizeof(dot11fIE->dscp_exceptions);
 	if (dot11fIE->num_dscp_exceptions > QOS_MAP_LEN_MAX)
 		dot11fIE->num_dscp_exceptions = QOS_MAP_LEN_MAX;
+	if (dot11fIE->num_dscp_exceptions < QOS_MAP_LEN_MIN)
+		return;
 	Qos->num_dscp_exceptions =
 		(dot11fIE->num_dscp_exceptions - QOS_MAP_LEN_MIN) / 2;