Pārlūkot izejas kodu

qcacld-3.0: Variable over written in hdd_set_app_type2_parser.

qcacld-2.0 to qcacld-3.0 propagation

Currently in hdd_set_app_type2_parser, sscanf writes 4 bytes of data in
tcp_src_port and tcp_dst_port variable. The original size of variable
is 2 byte.

Update code to write appropriate size of data in variable.

Change-Id: Ifdbfa06da6cb7d0bfef4f4e105a6911950f1d6ad
CRs-Fixed: 859493
Bhargav Shah 9 gadi atpakaļ
vecāks
revīzija
f4fd97d004
1 mainītis faili ar 3 papildinājumiem un 3 dzēšanām
  1. 3 3
      core/hdd/src/wlan_hdd_ioctl.c

+ 3 - 3
core/hdd/src/wlan_hdd_ioctl.c

@@ -1794,14 +1794,14 @@ static int hdd_set_app_type2_parser(hdd_adapter_t *adapter,
 
 	memset(&params, 0, sizeof(tSirAppType2Params));
 
-	ret = sscanf(arg, "%17s %16s %x %x %x %u %u %u %u %u %u %u %u %u %u",
+	ret = sscanf(arg, "%17s %16s %x %x %x %u %u %hu %hu %u %u %u %u %u %u",
 		     mac_addr, rc4_key, (unsigned int *)&params.ip_id,
 		     (unsigned int *)&params.ip_device_ip,
 		     (unsigned int *)&params.ip_server_ip,
 		     (unsigned int *)&params.tcp_seq,
 		     (unsigned int *)&params.tcp_ack_seq,
-		     (unsigned int *)&params.tcp_src_port,
-		     (unsigned int *)&params.tcp_dst_port,
+		     (uint16_t *)&params.tcp_src_port,
+		     (uint16_t *)&params.tcp_dst_port,
 		     (unsigned int *)&params.keepalive_init,
 		     (unsigned int *)&params.keepalive_min,
 		     (unsigned int *)&params.keepalive_max,