Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 66b5db45 authored by sandhu's avatar sandhu Committed by Madan Koyyalamudi
Browse files

qcacld-3.0: check staId index bound into timer array 

Check whether staId is not out of bound while accessing the
timer array.

Change-Id: I347c314a324934d4a62808551b1552aa4a76a5d7
CRs-Fixed: 3290301
parent c67e0400

core/mac/src/pe/lim/lim_timer_utils.c

+8 −3
Original line number Diff line number Diff line
@@ -751,11 +751,16 @@ lim_deactivate_and_change_per_sta_id_timer(struct mac_context *mac, uint32_t tim 
	switch (timerId) {

	case eLIM_CNF_WAIT_TIMER:



		if (tx_timer_deactivate

			    (&mac->lim.lim_timers.gpLimCnfWaitTimer[staId])

		if (staId >= (mac->lim.maxStation + 1)) {

			pe_err("Invalid staId = %d ", staId);

			return;

		}



		if (tx_timer_deactivate(&mac->lim.lim_timers.gpLimCnfWaitTimer[staId])

					!= TX_SUCCESS) {

			pe_err("unable to deactivate CNF wait timer");

		}



		/* Change timer to reactivate it in future */

		val = mac->mlme_cfg->sta.wait_cnf_timeout;

		val = SYS_MS_TO_TICKS(val);