Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 59144326 authored by lifeng's avatar lifeng Committed by Yeshwanth Sriram Guntuka
Browse files

wlan: Fix possible buffer overflow in sirConvertAddtsRsp2Struct

In the function sirConvertAddtsRsp2Struct, iterator j is
assigned with the value pAddTs->numTclas + addts.num_WMMTCLAS.
The j value is used as the index to the array pAddTs->tclasInfo.
Maximum limit on  pAddTs->tclasInfo entries is 2. So when the
value of j exceeds 2, then a possible buffer overflow could
occur.

Validate the value of j against SIR_MAC_TCLASIE_MAXNUM(2).

Change-Id: Icc723380ed4ccd51c729194d509e288be0e0712c
CRs-Fixed: 2449899
parent 51801583
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment