prima: Fix OOB read in lim_send_chan_switch_action_frame
In lim_send_chan_switch_action_frame, driver checks every node in STA hash table when sending action frame. When sending action frame, the driver will loop through the STA info hash table (dphHashTable) to find all the STA need to receive unicast action frame. The STA info stored in hash table (of size 41 bytes) from the second node to the last, the first node is empty. But the current loop is looping for 42 bytes (maxstation (of size 41 bytes) + 1) results Invalid memory access. Change the loop count to dphHashTable.size in order to stop OOB read in lim_send_chan_switch_action_frame. Change-Id: I2ee99d60c282b3f5ad660e3785ad554fb871b816 CRs-Fixed: 2356341
Loading
Please register or sign in to comment