浏览代码

qcacld-3.0: Fix static analysis error in limProcessTdls.c

qcacld-2.0 to qcacld-3.0 propagation

Currently while populating 11a and 11b rates, there is
no bound check for rateset array. This can result in buffer
overflow. As a part of fix add bound check to avoid any
buffer overflow for the rateset.

CRs-fixed: 798054
Change-Id: Ib42f5de642ad54d5c2a1ccdab37d88928b98af01
Sushant Kaushik 9 年之前
父节点
当前提交
28556aa279
共有 1 个文件被更改,包括 2 次插入4 次删除
  1. 2 4
      core/mac/src/pe/lim/lim_process_tdls.c

+ 2 - 4
core/mac/src/pe/lim/lim_process_tdls.c

@@ -2159,15 +2159,13 @@ lim_tdls_populate_matching_rate_set(tpAniSirGlobal mac_ctx, tpDphHashNode stads,
 				(temp_rate_set.rate[j] & 0x7F))
 				continue;
 
-#ifdef FEATURE_WLAN_NON_INTEGRATED_SOC
-			if ((b_rateindex > HAL_NUM_11B_RATES) ||
-			    (a_rateindex > HAL_NUM_11A_RATES)) {
+			if ((b_rateindex > SIR_NUM_11B_RATES) ||
+			    (a_rateindex > SIR_NUM_11A_RATES)) {
 				lim_log(mac_ctx, LOGE,
 					FL("Invalid number of rates (11b->%d, 11a->%d)"),
 					b_rateindex, a_rateindex);
 				return eSIR_FAILURE;
 			}
-#endif
 			if (sirIsArate(temp_rate_set2.rate[i] & 0x7f)) {
 				is_a_rate = 1;
 				if (a_rateindex < SIR_NUM_11A_RATES)