commit a631e899b6343427966e4ef9d8cd8877d2775025
author Mukul Sharma <mukul@qti.qualcomm.com> Thu Aug 28 15:38:51 2014 +0530
committer Kiet Lam <c_kietl@qca.qualcomm.com> Tue Sep 02 16:11:29 2014 -0700
tree 011b2b5d115028bdf768ab7f1e89f8fd7884874f
parent b9a1ae39412e14f2d726570b62d5e5168c183131

wlan: Fix Crash in csrProcessScanCommand

While moving smeConfig to heap from stack
in hdd_set_sme_config memzero passed with
wrong arguments (passed pointer instead of
primitive type) which lead to remain
garbage into the fscantwice ini value.

Change-Id: I6b8f536f37f92519a2a7e036d18d1ba77cfea774
CRs-Fixed: 716656

CORE/SME/src/csr/csrApiScan.c

diff --git a/CORE/SME/src/csr/csrApiScan.c b/CORE/SME/src/csr/csrApiScan.c
index 2af4e78..04dda62 100644
--- a/CORE/SME/src/csr/csrApiScan.c
+++ b/CORE/SME/src/csr/csrApiScan.c
@@ -5821,7 +5821,7 @@
             {
                 len = pCommand->u.scanCmd.u.scanRequest.ChannelInfo.numOfChannels;
                 //allocate twice the channel
-                newChannelInfo.ChannelList = (tANI_U8 *)vos_mem_malloc(newChannelInfo.numOfChannels * 2);
+                newChannelInfo.ChannelList = (tANI_U8 *)vos_mem_malloc(len * 2);
                 pChannel = pCommand->u.scanCmd.u.scanRequest.ChannelInfo.ChannelList;
             }
             else