Explorar o código

qcacld-3.0: Exclude length field size from max beacon payload size

Don't account length field size while comparing against max
beacon size.

Current driver starts from (ptr+4 bytes) then tries to copy
512 bytes from that point which creates to copy extra 4 bytes
beyond the array's boundary.

Instead copy only 508 bytes if driver starts copying from
(ptr+ 4bytes).

 ptr
  ^
  |
  |
  +---------------+--------------------------------+
  |               |                                |
  |  Length       |   Max Beacon payload           |
  |               |                                |
  +---------------+--------------------------------+

  |<-- 4 bytes -->|<-------- 508 bytes ----------->|

  |<-------------  512 bytes --------------------->|

CRs-Fixed: 2327052
Change-Id: I2646986ec424f7da31107ad01f673588734eaa52
Krunal Soni %!s(int64=6) %!d(string=hai) anos
pai
achega
2f5e3dd670
Modificáronse 1 ficheiros con 3 adicións e 3 borrados
  1. 3 3
      core/wma/src/wma_mgmt.c

+ 3 - 3
core/wma/src/wma_mgmt.c

@@ -2652,9 +2652,9 @@ static QDF_STATUS wma_store_bcn_tmpl(tp_wma_handle wma, uint8_t vdev_id,
 	}
 
 	len = *(u32 *) &bcn_info->beacon[0];
-	if (len > SIR_MAX_BEACON_SIZE) {
-		WMA_LOGE("%s: Received beacon len %d exceeding max limit %d",
-			 __func__, len, SIR_MAX_BEACON_SIZE);
+	if (len > SIR_MAX_BEACON_SIZE - sizeof(uint32_t)) {
+		WMA_LOGE("%s: Received beacon len %u exceeding max limit %lu",
+			 __func__, len, SIR_MAX_BEACON_SIZE - sizeof(uint32_t));
 		return QDF_STATUS_E_INVAL;
 	}
 	WMA_LOGD("%s: Storing received beacon template buf to local buffer",