Browse Source

qcacld-3.0: Fix invalid check in softap API

Some of softap APIs like hdd_softap_register_sta() contain sta_id
validation check against maximum value of HDD_MAX_ADAPTERS before
accessing adapter->sta_info[sta_id].

Since the maximum size of adapter->sta_info[] is WLAN_MAX_STA_COUNT
and less than HDD_MAX_ADAPTERS (used in sta_id index validation)
array out of bounds access is possible.

To fix this, validate sta_id index against maximum value of
WLAN_MAX_STA_COUNT instead of HDD_MAX_ADAPTERS.

Change-Id: I18390a76a3bee852a9d6ca3dde4382fa94387594
CRs-Fixed: 2486518
Rajeev Kumar Sirasanagandla 5 years ago
parent
commit
902680eec5
1 changed files with 3 additions and 3 deletions
  1. 3 3
      core/hdd/src/wlan_hdd_softap_tx_rx.c

+ 3 - 3
core/hdd/src/wlan_hdd_softap_tx_rx.c

@@ -977,7 +977,7 @@ QDF_STATUS hdd_softap_deregister_sta(struct hdd_adapter *adapter,
 
 	hdd_ctx = WLAN_HDD_GET_CTX(adapter);
 
-	if (sta_id >= HDD_MAX_ADAPTERS) {
+	if (sta_id >= WLAN_MAX_STA_COUNT) {
 		hdd_err("Error: Invalid sta_id: %u", sta_id);
 		return QDF_STATUS_E_INVAL;
 	}
@@ -1035,7 +1035,7 @@ QDF_STATUS hdd_softap_register_sta(struct hdd_adapter *adapter,
 	hdd_info("STA:%u, Auth:%u, Priv:%u, WMM:%u",
 		 sta_id, auth_required, privacy_required, wmm_enabled);
 
-	if (sta_id >= HDD_MAX_ADAPTERS) {
+	if (sta_id >= WLAN_MAX_STA_COUNT) {
 		hdd_err("Error: Invalid sta_id: %u", sta_id);
 		return qdf_status;
 	}
@@ -1156,7 +1156,7 @@ QDF_STATUS hdd_softap_register_bc_sta(struct hdd_adapter *adapter,
 	ap_ctx = WLAN_HDD_GET_AP_CTX_PTR(adapter);
 	sta_id = ap_ctx->broadcast_sta_id;
 
-	if (sta_id >= HDD_MAX_ADAPTERS) {
+	if (sta_id >= WLAN_MAX_STA_COUNT) {
 		hdd_err("Error: Invalid sta_id: %u", sta_id);
 		return qdf_status;
 	}