samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacmn: Avoid possible buffer overflow

Browse Source 
In function tdls_ct_sampling_tx_rx, memcpy of
unknown length buffer is done into fixed size
struct array. Mem copying without checking
length can lead to buffer overflow.

Change-Id: I0608bd69d71ff1901f82b44d045963e9d383e6ce
CRs-Fixed: 2269276
This commit is contained in:
Bala Venkatesh
2018-06-28 11:13:25 +05:30
committed by nshrivas
parent 1a3151ed20
commit 9bf4f33852
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
umac/tdls/core/src/wlan_tdls_ct.c
View File

@@ -223,7 +223,8 @@ static void tdls_ct_sampling_tx_rx(struct tdls_vdev_priv_obj *tdls_vdev,
return; return;
} }
mac_entries = tdls_vdev->valid_mac_entries; mac_entries = QDF_MIN(tdls_vdev->valid_mac_entries,
WLAN_TDLS_CT_TABLE_SIZE);
qdf_mem_copy(mac_table, tdls_vdev->ct_peer_table, qdf_mem_copy(mac_table, tdls_vdev->ct_peer_table,
(sizeof(struct tdls_conn_tracker_mac_table)) * mac_entries); (sizeof(struct tdls_conn_tracker_mac_table)) * mac_entries);