Browse Source

qcacld-3.0: Incorrect MCS index is passed

Fix the potential out of bound read of the supported MCS rate
array.

Change-Id: I172dcac9d1ce79b16e4cd2a4ee321d9e93102866
CRs-Fixed: 3304227
Sandeep Puligilla 2 years ago
parent
commit
4b08781ef4
1 changed files with 4 additions and 0 deletions
  1. 4 0
      core/hdd/src/wlan_hdd_hostapd.c

+ 4 - 0
core/hdd/src/wlan_hdd_hostapd.c

@@ -1257,6 +1257,10 @@ static int calcuate_max_phy_rate(int mode, int nss, int ch_width,
 	if (mode == SIR_SME_PHY_MODE_HT) {
 		/* check for HT Mode */
 		maxidx = ht_mcs_idx;
+		if (maxidx > 7) {
+			hdd_err("ht_mcs_idx %d is incorrect", ht_mcs_idx);
+			return maxrate;
+		}
 		if (nss == 1) {
 			supported_mcs_rate = supported_mcs_rate_nss1;
 		} else if (nss == 2) {