Преглед изворни кода

qcacld-3.0: Fix for crash caused by buffer overflow

qcacld-2.0 to qcacld-3.0 propagation

In sme_update_dsc_pto_up_mapping() function, we try to write into
the array dscpmapping in 255th location, if the location index
happens to be 255. But the size of dscpmapping array is 64 only
which is causing out of boundary access resulting in crash.

To address this, avoid writing in out of boundary. If the DSCP
range is 255, there is no mapping for such priority, so there is
no need assign anything for dscpmapping.

CRs-Fixed: 1027457
Change-Id: Ic4299122b10a990d17816f864ef8415c1b75b230
Deepthi Gowri пре 8 година
родитељ
комит
973890eeb9
1 измењених фајлова са 0 додато и 1 уклоњено
  1. 0 1
      core/sme/src/common/sme_api.c

+ 0 - 1
core/sme/src/common/sme_api.c

@@ -13236,7 +13236,6 @@ QDF_STATUS sme_update_dsc_pto_up_mapping(tHalHandle hHal,
 			if ((pSession->QosMapSet.dscp_range[i][0] == 255)
 				&& (pSession->QosMapSet.dscp_range[i][1] ==
 							255)) {
-				dscpmapping[j] = 0;
 				QDF_TRACE(QDF_MODULE_ID_SME,
 					QDF_TRACE_LEVEL_ERROR,
 					FL("User Priority %d isn't used"), i);