samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacld-3.0: Fix possible OOB in wma_unified_radio_tx_mem_free()

Browse Source 
In wma_unified_radio_tx_mem_free() function, results buffer array may be
dereferenced with large index value, that may result OOB memory access.

Fix the same by correcting incrementing pointer to results buffer.

Change-Id: I57a26dba9db32758c7d7fd51b99d3364a8020a9d
CRs-Fixed: 2308644
This commit is contained in:
Arif Hussain
2018-09-14 16:52:24 -07:00
committed by nshrivas
parent 0b0463506c
commit 6b0ed167ad
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
core/wma/src/wma_utils.c
View File

@@ -1411,7 +1411,6 @@ int wma_unified_radio_tx_mem_free(void *handle)
rs_results = (tSirWifiRadioStat *)
&wma_handle->link_stats_results->results[0];
for (i = 0; i < wma_handle->link_stats_results->num_radio; i++) {
rs_results += i;
if (rs_results->tx_time_per_power_level) {
qdf_mem_free(rs_results->tx_time_per_power_level);
rs_results->tx_time_per_power_level = NULL;
@@ -1421,6 +1420,7 @@ int wma_unified_radio_tx_mem_free(void *handle)
qdf_mem_free(rs_results->channels);
rs_results->channels = NULL;
}
rs_results++;
}
qdf_mem_free(wma_handle->link_stats_results);