samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacmn: Fix memory overflow in wmi roam scan filter cmd

Browse Source 
The length of buffer used to send wmi roam scan filter cmd is not
properly calculated and thus the length is less than the actual data
to be copied.

Fix it by properly calculating the length of the buffer.

Change-Id: I6a3baa5ca5560d2d04f9bd41a709a37abc1b95a9
CRs-Fixed: 2072057
This commit is contained in:
Abhishek Singh
2017-07-06 11:25:15 +05:30
committed by Nandini Suresh
parent d99852a914
commit 54aa620814
1 changed files with 14 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

15
wmi_unified_tlv.c
View File

@@ -5885,8 +5885,21 @@ static QDF_STATUS send_roam_scan_filter_cmd_tlv(wmi_unified_t wmi_handle,
wmi_roam_lca_disallow_config_tlv_param *blist_param;
len = sizeof(wmi_roam_filter_fixed_param);
len += WMI_TLV_HDR_SIZE;
len += roam_req->len;
if (roam_req->num_bssid_black_list)
len += roam_req->num_bssid_black_list * sizeof(wmi_mac_addr);
len += WMI_TLV_HDR_SIZE;
if (roam_req->num_ssid_white_list)
len += roam_req->num_ssid_white_list * sizeof(wmi_ssid);
len += 2 * WMI_TLV_HDR_SIZE;
if (roam_req->num_bssid_preferred_list) {
len += roam_req->num_bssid_preferred_list * sizeof(wmi_mac_addr);
len += roam_req->num_bssid_preferred_list * sizeof(A_UINT32);
}
if (roam_req->lca_disallow_config_present)
len += WMI_TLV_HDR_SIZE +
sizeof(wmi_roam_lca_disallow_config_tlv_param);
buf = wmi_buf_alloc(wmi_handle, len);
if (!buf) {