瀏覽代碼

qcacmn: Check pcl array size against QDF_MAX_NUM_CHAN

While populating preferred channel list array, length
has not been checked against QDF_MAX_NUM_CHAN which
is size of PCL.

Fix it by checking indices and length against QDF_MAX_NUM_CHAN

CRs-Fixed: 2169424
Change-Id: I8c4d050bfc7040fba052eb42b32a91302a0a0ecb
Krunal Soni 7 年之前
父節點
當前提交
5428570e41
共有 1 個文件被更改,包括 5 次插入1 次删除
  1. 5 1
      umac/cmn_services/policy_mgr/src/wlan_policy_mgr_pcl.c

+ 5 - 1
umac/cmn_services/policy_mgr/src/wlan_policy_mgr_pcl.c

@@ -1540,6 +1540,10 @@ QDF_STATUS policy_mgr_modify_sap_pcl_based_on_mandatory_channel(
 
 	for (i = 0; i < *pcl_len_org; i++) {
 		found = false;
+		if (i >= QDF_MAX_NUM_CHAN) {
+			policy_mgr_debug("index is exceeding QDF_MAX_NUM_CHAN");
+			break;
+		}
 		for (j = 0; j < pm_ctx->sap_mandatory_channels_len; j++) {
 			if (pcl_list_org[i] ==
 			    pm_ctx->sap_mandatory_channels[j]) {
@@ -1547,7 +1551,7 @@ QDF_STATUS policy_mgr_modify_sap_pcl_based_on_mandatory_channel(
 				break;
 			}
 		}
-		if (found) {
+		if (found && (pcl_len < QDF_MAX_NUM_CHAN)) {
 			pcl_list[pcl_len] = pcl_list_org[i];
 			weight_list[pcl_len++] = weight_list_org[i];
 		}