Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 95b7a746 authored by Will Huang's avatar Will Huang Committed by nshrivas
Browse files

qcacmn: Fix possible OOB in extract_ocb_dcc_stats_tlv

The correct element number of param_tlvs->stats_per_channel_list is
actually param_tlvs->num_stats_per_channel_list and thus the
qdf_mem_copy() can actually copy more bytes than are in the buffer
causing a buffer overread.

Fix it by checking fix_param->num_channels against the actually
param_tlvs->num_stats_per_channel_list before doing memory copy.

Change-Id: I610920ac1d0a927a52de83935616e8e8fdfec7e7
CRs-Fixed: 2428212
parent 838a9a4a
Loading
Loading
Loading
Loading
0% Loading or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment