From 155f6cd98d29cc962ed59d5462ea76c36f87e054 Mon Sep 17 00:00:00 2001
From: bings <bings@codeaurora.org>
Date: Wed, 4 Dec 2019 14:13:05 +0800
Subject: [PATCH] wlan: fix buffer overflow in
 psessionEntry->pSchBeaconFrameBegin

psessionEntry->pSchBeaconFrameBegin is allocated with fix length
SCH_MAX_BEACON_SIZE. Do not copy the value to the buffer exceeding
psessionEntry->pSchBeaconFrameBegin.

Change-Id: I539692c01753b991a963b0416177cf5b474cfdf8
CRs-Fixed: 2579375
---
 drivers/staging/prima/CORE/MAC/src/pe/sch/schBeaconGen.c | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/drivers/staging/prima/CORE/MAC/src/pe/sch/schBeaconGen.c b/drivers/staging/prima/CORE/MAC/src/pe/sch/schBeaconGen.c
index 8def5f3a89f..dc8dd5a837b 100644
--- a/drivers/staging/prima/CORE/MAC/src/pe/sch/schBeaconGen.c
+++ b/drivers/staging/prima/CORE/MAC/src/pe/sch/schBeaconGen.c
@@ -742,6 +742,13 @@ void writeBeaconToMemory(tpAniSirGlobal pMac, tANI_U16 size, tANI_U16 length, tp
     // copy end of beacon only if length > 0
     if (length > 0)
     {
+        if (size + pMac->sch.schObject.gSchBeaconOffsetEnd >
+            SCH_MAX_BEACON_SIZE) {
+            PELOGE(schLog(pMac, LOGE,
+                   FL("beacon template fail size %d BeaconOffsetEnd %d"),
+                   size, pMac->sch.schObject.gSchBeaconOffsetEnd);)
+            return;
+        }
         for (i=0; i < pMac->sch.schObject.gSchBeaconOffsetEnd; i++)
             pMac->sch.schObject.gSchBeaconFrameBegin[size++] = pMac->sch.schObject.gSchBeaconFrameEnd[i];
     }