samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacld-3.0: Fix OOB write in lim_populate_peer_rate_set

Browse Source 
To poiulate peer rates (Supproted rates, HT & VHT Capabilities)
lim_populate_peer_rate_set first copy values of
psessionEntry->rateSet.rate in a local buffer tempRateSet for
sorting of rates. Currently while copying, index for
psessionEntry->rateSet.rate bufffer varies from 0 to max rate
allowed SIR_MAC_RATESET_EID_MAX(12). This results access of 13th
index(OOB) of psessionEntry->rateSet.rate buffer.

The fix is to set proper upper bound to copy values of
psessionEntry->rateSet.rate in to a local buffer tempRateSet.

Change-Id: I75d5f5b5e7d44665101dae6e095b4adadc1781fb
CRs-Fixed: 2268610
This commit is contained in:
Abhinav Kumar
2018-06-27 11:26:53 +05:30
committed by nshrivas
parent 9f958141a1
commit ccd1bed788
1 changed files with 1 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

2
core/mac/src/pe/lim/lim_assoc_utils.c
View File

@@ -1691,7 +1691,7 @@ lim_populate_peer_rate_set(tpAniSirGlobal pMac,
} }
} else } else
tempRateSet2.numRates = 0; tempRateSet2.numRates = 0;
if ((tempRateSet.numRates + tempRateSet2.numRates) > if ((tempRateSet.numRates + tempRateSet2.numRates) >=
SIR_MAC_RATESET_EID_MAX) { SIR_MAC_RATESET_EID_MAX) {
pe_err("more than 12 rates in CFG"); pe_err("more than 12 rates in CFG");
return QDF_STATUS_E_FAILURE; return QDF_STATUS_E_FAILURE;