commit 96279551e1e07b1f64203607f5c01d1260932441
author yeshwanth sriram guntuka <ysriramg@codeaurora.org> Tue Aug 01 15:02:26 2017 +0530
committer Gerrit - the friendly Code Review server <code-review@localhost> Tue Aug 08 03:55:03 2017 -0700
tree 9f897dd897737da36069ef10cd95017dbda8bb7d
parent 5eb108d22a6b94a309fcdf1f829f1b69068b1010

wlan: Fix kernel memory corruption

Buffer overflow in ConvertQosMapsetFrame function
when num_dscp_exceptions value is less than 16.

Fix is to return from function if num_dscp_exceptions
is less than 16.

Change-Id: I2fcce60b7fe5e988348cee786e9a4d493d9512fe
CRs-Fixed: 2086305

CORE/SYS/legacy/src/utils/src/utilsParser.c

diff --git a/CORE/SYS/legacy/src/utils/src/utilsParser.c b/CORE/SYS/legacy/src/utils/src/utilsParser.c
index 3292b5c..32f1992 100644
--- a/CORE/SYS/legacy/src/utils/src/utilsParser.c
+++ b/CORE/SYS/legacy/src/utils/src/utilsParser.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2015, 2017 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -691,6 +691,8 @@
     tANI_U8 i,j=0;
     if (dot11fIE->num_dscp_exceptions > 58)
         dot11fIE->num_dscp_exceptions = 58;
+    if (dot11fIE->num_dscp_exceptions < 16)
+        return;
     Qos->num_dscp_exceptions = (dot11fIE->num_dscp_exceptions - 16)/2;
     for (i=0;i<Qos->num_dscp_exceptions;i++)
     {