rubenslte/android_kernel_samsung_msm8226-rubenslte
1
Fork 0
forked from rubenslte/android_kernel_samsung_msm8226
Code Pull Requests Activity

wlan: Fix buffer overwrite in csrRoamCheckForLinkStatusChange

Browse Source 
Fix possible buffer overwrite in csrRoamCheckForLinkStatusChange
function on receiving eSIR_SME_JOINED_NEW_BSS message.

Change-Id: Icf4a39e0a2a291f1c084353985aa7952e3c8e136
CRs-Fixed: 2294790
This commit is contained in:
Yeshwanth Sriram Guntuka
2020-05-21 10:55:03 +02:00
committed by Francescodario Cuzzocrea
parent 7eeb3b125a
commit 76217eecb4
1 changed files with 8 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/staging/prima/CORE/SME/src/csr/csrApiRoam.c
+8 -5
View File
@@ -10128,11 +10128,14 @@ void csrRoamCheckForLinkStatusChange( tpAniSirGlobal pMac, tSirSmeRsp *pSirMsg )
if(pNewBss)
{
vos_mem_copy(pIbssLog->bssid, pNewBss->bssId, 6);
if(pNewBss->ssId.length)
{
vos_mem_copy(pIbssLog->ssid, pNewBss->ssId.ssId,
pNewBss->ssId.length);
}
if(pNewBss->ssId.length >
VOS_LOG_MAX_SSID_SIZE)
pNewBss->ssId.length =
VOS_LOG_MAX_SSID_SIZE;
vos_mem_copy(pIbssLog->ssid,
pNewBss->ssId.ssId,
pNewBss->ssId.length);
pIbssLog->operatingChannel = pNewBss->channelNumber;
}
if(HAL_STATUS_SUCCESS(ccmCfgGetInt(pMac, WNI_CFG_BEACON_INTERVAL, &bi)))