소스 검색

qcacmn: Fix buffer overflow when radiotap header is larger than available headroom

The condition which detects if the length of the radiotap header is
greater than the available headroom in the skb is incorrect.

Correction to check if sufficient headroom is available
for updating the radiotap header.

Change-Id: I71c140c6af415678efe66cff2f16b8cabc62697a
CRs-Fixed: 2047909
Rakesh Pillai 8 년 전
부모
커밋
847482ff8e
1개의 변경된 파일1개의 추가작업 그리고 1개의 파일을 삭제
  1. 1 1
      qdf/linux/src/qdf_nbuf.c

+ 1 - 1
qdf/linux/src/qdf_nbuf.c

@@ -2748,7 +2748,7 @@ unsigned int qdf_nbuf_update_radiotap(struct mon_rx_status *rx_status,
 	}
 	rthdr->it_len = cpu_to_le16(rtap_len);
 
-	if ((headroom_sz  - rtap_len) < 0) {
+	if (headroom_sz < rtap_len) {
 		qdf_print("ERROR: not enough space to update radiotap\n");
 		return 0;
 	}