Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit ac8eb165 authored by Srinivas Dasari's avatar Srinivas Dasari Committed by snandini
Browse files

qcacmn: Possible buffer overflow while copying rnr info 

A temporary variable "temp" is declared to use it while sorting
the channels based on the weightage/rnr info. This is declared
as a pointer to hold the reference of struct rnr_chan_weight but
memcpy is done to this without allocating memory.
Declare this as a variable instead of pointer to use it as an
intermediate variable for sorting.

Change-Id: If619f5fa462d5400f0a77e57317ac3c8debb34a5
CRs-Fixed: 2842819
parent 872cac88

umac/scan/core/src/wlan_scan_manager.c

+1 −1
Original line number Diff line number Diff line
@@ -956,7 +956,7 @@ static void scm_sort_6ghz_channel_list(struct wlan_objmgr_vdev *vdev, 
	uint8_t i, j = 0, max, tmp_list_count;

	struct meta_rnr_channel *channel;

	struct chan_info temp_list[MAX_6GHZ_CHANNEL];

	struct rnr_chan_weight *rnr_chan_info, *temp;

	struct rnr_chan_weight *rnr_chan_info, temp;

	uint32_t weight;

	struct wlan_objmgr_psoc *psoc;