rubenslte/android_kernel_samsung_msm8226-rubenslte
1
Fork 0
forked from rubenslte/android_kernel_samsung_msm8226
Code Pull Requests Activity

wlan: fix buffer overflow in psessionEntry->pSchBeaconFrameBegin

Browse Source 
psessionEntry->pSchBeaconFrameBegin is allocated with fix length
SCH_MAX_BEACON_SIZE. Do not copy the value to the buffer exceeding
psessionEntry->pSchBeaconFrameBegin.

Change-Id: I539692c01753b991a963b0416177cf5b474cfdf8
CRs-Fixed: 2579375
This commit is contained in:
bings
2021-10-10 23:46:47 +02:00
committed by Francescodario Cuzzocrea
parent e3b0411e00
commit 155f6cd98d
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/staging/prima/CORE/MAC/src/pe/sch/schBeaconGen.c
+7
View File
@@ -742,6 +742,13 @@ void writeBeaconToMemory(tpAniSirGlobal pMac, tANI_U16 size, tANI_U16 length, tp
// copy end of beacon only if length > 0
if (length > 0)
{
if (size + pMac->sch.schObject.gSchBeaconOffsetEnd >
SCH_MAX_BEACON_SIZE) {
PELOGE(schLog(pMac, LOGE,
FL("beacon template fail size %d BeaconOffsetEnd %d"),
size, pMac->sch.schObject.gSchBeaconOffsetEnd);)
return;
}
for (i=0; i < pMac->sch.schObject.gSchBeaconOffsetEnd; i++)
pMac->sch.schObject.gSchBeaconFrameBegin[size++] = pMac->sch.schObject.gSchBeaconFrameEnd[i];
}