Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Unverified Commit c1da63f0 authored by Michael Bestas's avatar Michael Bestas
Browse files

Merge tag 'LA.UM.9.12.r1-18200-SMxx50.QSSI14.0' of... 

Merge tag 'LA.UM.9.12.r1-18200-SMxx50.QSSI14.0' of https://git.codelinaro.org/clo/la/platform/vendor/qcom-opensource/wlan/qca-wifi-host-cmn into android13-4.19-kona

"LA.UM.9.12.r1-18200-SMxx50.QSSI14.0"

* tag 'LA.UM.9.12.r1-18200-SMxx50.QSSI14.0' of https://git.codelinaro.org/clo/la/platform/vendor/qcom-opensource/wlan/qca-wifi-host-cmn:
  qcacmn: Fix out of bound read issue in ESP ie parse

Change-Id: I3a6260d641417d3580f29f570246df0faa538606
parents e061c250 50240b49

drivers/staging/qca-wifi-host-cmn/umac/scan/dispatcher/src/wlan_scan_utils_api.c

+4 −3
Original line number Diff line number Diff line 
/*

 * Copyright (c) 2017-2021 The Linux Foundation. All rights reserved.

 * Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.

 * Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.

 *

 * Permission to use, copy, modify, and/or distribute this software for

 * any purpose with or without fee is hereby granted, provided that the
@@ -1185,7 +1185,8 @@ static void util_scan_update_esp_data(struct wlan_esp_ie *esp_information, 
	esp_ie = (struct wlan_esp_ie *)

		util_scan_entry_esp_info(scan_entry);



	total_elements  = esp_ie->esp_len;

	// Ignore ESP_ID_EXTN element

	total_elements  = esp_ie->esp_len - 1;

	data = (uint8_t *)esp_ie + 3;

	do_div(total_elements, ESP_INFORMATION_LIST_LENGTH);
@@ -1195,7 +1196,7 @@ static void util_scan_update_esp_data(struct wlan_esp_ie *esp_information, 
	}



	for (i = 0; i < total_elements &&

	     data < ((uint8_t *)esp_ie + esp_ie->esp_len + 3); i++) {

	     data < ((uint8_t *)esp_ie + esp_ie->esp_len); i++) {

		esp_info = (struct wlan_esp_info *)data;

		if (esp_info->access_category == ESP_AC_BK) {

			qdf_mem_copy(&esp_information->esp_info_AC_BK,