Before copy tx power, need check length correctly to avoid buffer overflow. Change-Id: Ib18feaa36d3cbdcc50442885fd8b98888f34eab8 CRs-Fixed: 2538397
@@ -1557,7 +1557,7 @@ static void csr_save_tx_power_to_cfg(struct mac_context *mac,
count++;
}
} else {
- if (cbLen >= dataLen) {
+ if (cbLen + sizeof(tSirMacChanInfo) >= dataLen) {
/* this entry will overflow our allocation */
sme_err(
"Buffer overflow, start freq %d, num %d, offset %d",