wlan: memory corruption fix in send action frame
The code incorrectly allocated sizeof(*len) where it
supposed to have allocated *len bytes. This caused the code
to always allocate one byte and try to corrupt the other memory
location.
Fix this with proper allocation.
Change-Id: Id6e4c44df2d6e32091957142f13130655cbfbf93
CRs-Fixed: 466929
diff --git a/CORE/HDD/src/wlan_hdd_main.c b/CORE/HDD/src/wlan_hdd_main.c
index a6dd988..7b35388 100644
--- a/CORE/HDD/src/wlan_hdd_main.c
+++ b/CORE/HDD/src/wlan_hdd_main.c
@@ -2134,7 +2134,14 @@
}
if ( *pBufLen <= 0) return -EINVAL;
- *pBuf = vos_mem_malloc(sizeof(*pBufLen));
+ /* Allocate the number of bytes based on the number of input characters
+ whether it is even or odd.
+ if the number of input characters are even, then we need N/2 byte.
+ if the number of input characters are odd, then we need do (N+1)/2 to
+ compensate rounding off.
+ For example, if N = 18, then (18 + 1)/2 = 9 bytes are enough.
+ If N = 19, then we need 10 bytes, hence (19 + 1)/2 = 10 bytes */
+ *pBuf = vos_mem_malloc((*pBufLen + 1)/2);
if (NULL == *pBuf)
{
hddLog(VOS_TRACE_LEVEL_FATAL,