浏览代码

qcacmn: Fix OOB access in utils_dfs_get_chan_list

Fix out of bound access for array "weight_list" with size 55 bytes
and declared on stack of function utils_dfs_get_chan_list. Same memory
is accessed in function policy_mgr_update_with_safe_channel_list with
index 127, leading to OOB access.

Change-Id: Ib7ba74e0096e90fd197bc563d2e82e497cf83759
CRs-Fixed: 2232833
Naveen Rawat 6 年之前
父节点
当前提交
8d36892372
共有 1 个文件被更改,包括 2 次插入2 次删除
  1. 2 2
      umac/dfs/dispatcher/src/wlan_dfs_utils_api.c

+ 2 - 2
umac/dfs/dispatcher/src/wlan_dfs_utils_api.c

@@ -536,8 +536,8 @@ static void utils_dfs_get_channel_list(struct wlan_objmgr_pdev *pdev,
 static void utils_dfs_get_chan_list(struct wlan_objmgr_pdev *pdev,
 static void utils_dfs_get_chan_list(struct wlan_objmgr_pdev *pdev,
 	struct dfs_channel *chan_list, uint32_t *num_chan)
 	struct dfs_channel *chan_list, uint32_t *num_chan)
 {
 {
-	uint8_t pcl_ch[NUM_CHANNELS] = {0};
-	uint8_t weight_list[NUM_CHANNELS] = {0};
+	uint8_t pcl_ch[QDF_MAX_NUM_CHAN] = {0};
+	uint8_t weight_list[QDF_MAX_NUM_CHAN] = {0};
 	uint32_t len;
 	uint32_t len;
 	uint32_t weight_len;
 	uint32_t weight_len;
 	int i;
 	int i;