浏览代码

qcacld-3.0: Fix for crash caused by buffer overflow

qcacld-2.0 to qcacld-3.0 propagation

In sme_update_dsc_pto_up_mapping() function, we try to write into
the array dscpmapping in 255th location, if the location index
happens to be 255. But the size of dscpmapping array is 64 only
which is causing out of boundary access resulting in crash.

To address this, avoid writing in out of boundary. If the DSCP
range is 255, there is no mapping for such priority, so there is
no need assign anything for dscpmapping.

CRs-Fixed: 1027457
Change-Id: Ic4299122b10a990d17816f864ef8415c1b75b230
Deepthi Gowri 8 年之前
父节点
当前提交
973890eeb9
共有 1 个文件被更改,包括 0 次插入1 次删除
  1. 0 1
      core/sme/src/common/sme_api.c

+ 0 - 1
core/sme/src/common/sme_api.c

@@ -13236,7 +13236,6 @@ QDF_STATUS sme_update_dsc_pto_up_mapping(tHalHandle hHal,
 			if ((pSession->QosMapSet.dscp_range[i][0] == 255)
 				&& (pSession->QosMapSet.dscp_range[i][1] ==
 							255)) {
-				dscpmapping[j] = 0;
 				QDF_TRACE(QDF_MODULE_ID_SME,
 					QDF_TRACE_LEVEL_ERROR,
 					FL("User Priority %d isn't used"), i);