commit 2c26e90bc63e0ea6882fadce22430bd31d7aea04
author Girish Gowli <c_ggowli@qti.qualcomm.com> Mon Oct 20 22:18:17 2014 +0530
committer AnjaneeDevi Kapparapu <c_akappa@qti.qualcomm.com> Mon Oct 27 12:32:47 2014 +0530
tree 48a3dfcde00ed4bef67b24c9e50352700c47e1f1
parent 386e76cbc662ed0af05a4ddd09b6a502220bb24f

Wlan: Use correct max size enum to access BkidCacheInfo array

In csrRoamGetBKIDCache(), CSR_MAX_PMKID_ALLOWED is used instead of
CSR_MAX_BKID_ALLOWED. This leads to array out of bound access of
'BkidCacheInfo' array.
Replacing CSR_MAX_PMKID_ALLOWED with  CSR_MAX_BKID_ALLOWED.

Change-Id: I258f9e79ca2793394b191c9a21790b443481de48
CRs-Fixed: 737735

CORE/SME/src/csr/csrApiRoam.c

diff --git a/CORE/SME/src/csr/csrApiRoam.c b/CORE/SME/src/csr/csrApiRoam.c
index e89761c..f5309c2 100644
--- a/CORE/SME/src/csr/csrApiRoam.c
+++ b/CORE/SME/src/csr/csrApiRoam.c
@@ -12149,11 +12149,11 @@
        }
        else if(*pNum >= pSession->NumBkidCache)
        {
-           if(pSession->NumBkidCache > CSR_MAX_PMKID_ALLOWED)
+           if(pSession->NumBkidCache > CSR_MAX_BKID_ALLOWED)
            {
-               smsLog(pMac, LOGE, FL("NumPmkidCache :%d is more than CSR_MAX_PMKID_ALLOWED, resetting to CSR_MAX_PMKID_ALLOWED"),
+               smsLog(pMac, LOGE, FL("NumBkidCache :%d is more than CSR_MAX_BKID_ALLOWED, resetting to CSR_MAX_BKID_ALLOWED"),
                  pSession->NumBkidCache);
-               pSession->NumBkidCache = CSR_MAX_PMKID_ALLOWED;
+               pSession->NumBkidCache = CSR_MAX_BKID_ALLOWED;
            }
            vos_mem_copy(pBkidCache, pSession->BkidCacheInfo,
                         sizeof(tBkidCacheInfo) * pSession->NumBkidCache);