commit bc6490d9db0df6a697f1c95df7ed1de2842390c5
author CNSS_WLAN Service <cnssbldsw@qualcomm.com> Tue Nov 13 00:47:10 2018 -0800
committer Gerrit - the friendly Code Review server <code-review@localhost> Tue Nov 13 00:47:10 2018 -0800
tree 8cd0e726aecd67a37bb1d579014e7436051ffc82
parent 274ab2a3498f760ef1d4a4225edb30b78d51afd2
parent 62aa8d5052f7e95a1cf459c7a61a19ca03588951

Merge "wlan: Fix buffer overwrite in limMlmAddBss()" into wlan-driver.lnx.1.0

CORE/MAC/src/pe/lim/limProcessMlmReqMessages.c

diff --git a/CORE/MAC/src/pe/lim/limProcessMlmReqMessages.c b/CORE/MAC/src/pe/lim/limProcessMlmReqMessages.c
index 339bc53..a3c05cb 100644
--- a/CORE/MAC/src/pe/lim/limProcessMlmReqMessages.c
+++ b/CORE/MAC/src/pe/lim/limProcessMlmReqMessages.c
@@ -1763,7 +1763,7 @@
             pAddBssParams->rateSet.numRates = SIR_MAC_RATESET_EID_MAX;
     }
     vos_mem_copy(pAddBssParams->rateSet.rate,
-                 pMlmStartReq->rateSet.rate, pMlmStartReq->rateSet.numRates);
+                 pMlmStartReq->rateSet.rate, pAddBssParams->rateSet.numRates);
 
     pAddBssParams->nwType = pMlmStartReq->nwType;
 
@@ -1798,7 +1798,7 @@
     }
     vos_mem_copy(pAddBssParams->ssId.ssId,
                  pMlmStartReq->ssId.ssId,
-                 pMlmStartReq->ssId.length);
+                 pAddBssParams->ssId.length);
 
     pAddBssParams->bHiddenSSIDEn = pMlmStartReq->ssidHidden;
     limLog( pMac, LOGE, FL( "TRYING TO HIDE SSID %d" ),pAddBssParams->bHiddenSSIDEn);