瀏覽代碼

qcacmn: Possible buffer overflow while copying rnr info

A temporary variable "temp" is declared to use it while sorting
the channels based on the weightage/rnr info. This is declared
as a pointer to hold the reference of struct rnr_chan_weight but
memcpy is done to this without allocating memory.
Declare this as a variable instead of pointer to use it as an
intermediate variable for sorting.

Change-Id: If619f5fa462d5400f0a77e57317ac3c8debb34a5
CRs-Fixed: 2842819
Srinivas Dasari 4 年之前
父節點
當前提交
865573d455
共有 1 個文件被更改,包括 1 次插入1 次删除
  1. 1 1
      umac/scan/core/src/wlan_scan_manager_6ghz.c

+ 1 - 1
umac/scan/core/src/wlan_scan_manager_6ghz.c

@@ -54,7 +54,7 @@ scm_sort_6ghz_channel_list(struct wlan_objmgr_vdev *vdev,
 	uint8_t i, j = 0, max, tmp_list_count;
 	struct meta_rnr_channel *channel;
 	struct chan_info temp_list[MAX_6GHZ_CHANNEL];
-	struct rnr_chan_weight *rnr_chan_info, *temp;
+	struct rnr_chan_weight *rnr_chan_info, temp;
 	uint32_t weight;
 	struct wlan_objmgr_psoc *psoc;