qcacld-3.0: Avoid OOB in function tdls_ct_idle_handler
In function tdls_ct_idle_handler, idx is assigned from tdls_info->index which can be 0 254. But tdls_conn_info is static array in tdls_soc_priv_obj of size WLAN_TDLS_STA_MAX_NUM (8). So check idx is less than WLAN_TDLS_STA_MAX_NUM or not to avoid OOB memory access. Change-Id: I8387cb0a44a79f0f83b25c12de2aa9fbc39ab2f3 CRs-Fixed: 2474432
This commit is contained in:

gecommit door
nshrivas

bovenliggende
db24dda371
commit
4e3f275a80
@@ -639,7 +639,7 @@ void tdls_ct_idle_handler(void *user_data)
|
||||
return;
|
||||
|
||||
idx = tdls_info->index;
|
||||
if (tdls_info->index == INVALID_TDLS_PEER_INDEX)
|
||||
if (idx == INVALID_TDLS_PEER_INDEX || idx >= WLAN_TDLS_STA_MAX_NUM)
|
||||
return;
|
||||
|
||||
tdls_soc_obj = qdf_container_of(tdls_info, struct tdls_soc_priv_obj,
|
||||
|
Verwijs in nieuw issue
Block a user