Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit fd49e989 authored by Nagalakshmi's avatar Nagalakshmi Committed by Gerrit - the friendly Code Review server
Browse files

qcacld-3.0: Fix OOB in wma_scan_roam.c 

Currently in wma_extscan_hotlist_match_event_handler
API, dest_hotlist get memory allocation based on numap
which takes value from event->total_entries.
But numap is limited to WMA_EXTSCAN_MAX_HOTLIST_ENTRIES
and event->total_entries more than WMA_EXTSCAN_MAX_HOTLIST_ENTRIES
can cause out of bound issue.

Fix is to populate dest_hotlist->numOfAps from numap
instead of event->total_entries to avoid any out of bound issue.

Change-Id: I756f7e4a4dcd454508bba83d4a8bbbb139530905
CRs-Fixed: 3346781
parent 312e5c09

core/wma/src/wma_scan_roam.c

+1 −1
Original line number Diff line number Diff line
@@ -4965,7 +4965,7 @@ int wma_extscan_hotlist_match_event_handler(void *handle, 
		return -ENOMEM;



	dest_ap = &dest_hotlist->ap[0];

	dest_hotlist->numOfAps = event->total_entries;

	dest_hotlist->numOfAps = numap;

	dest_hotlist->requestId = event->config_request_id;



	if (event->first_entry_index +