wlan: Array out of bound in hdd change station
There is an array out of bound access in
__wlan_hdd_change_station api while filling the supported channels
in local variable.
Add a check to make sure that supported channels array never
indexed beyond SIR_MAC_MAX_SUPP_CHANNELS.
Change-Id: If1031196001be3ccc583804ef3661a1afe5422fc
CRs-Fixed: 2231005
diff --git a/CORE/HDD/src/wlan_hdd_cfg80211.c b/CORE/HDD/src/wlan_hdd_cfg80211.c
index 477f3f8..9f32185 100644
--- a/CORE/HDD/src/wlan_hdd_cfg80211.c
+++ b/CORE/HDD/src/wlan_hdd_cfg80211.c
@@ -12997,14 +12997,16 @@
*/
if (0 != params->supported_channels_len) {
int i = 0,j = 0,k = 0, no_of_channels = 0 ;
- for ( i = 0 ; i < params->supported_channels_len ; i+=2)
+ for ( i = 0 ; i < params->supported_channels_len
+ && j < SIR_MAC_MAX_SUPP_CHANNELS; i+=2)
{
int wifi_chan_index;
StaParams.supported_channels[j] = params->supported_channels[i];
wifi_chan_index =
((StaParams.supported_channels[j] <= HDD_CHANNEL_14 ) ? 1 : 4 );
no_of_channels = params->supported_channels[i+1];
- for(k=1; k <= no_of_channels; k++)
+ for(k=1; k <= no_of_channels
+ && j < SIR_MAC_MAX_SUPP_CHANNELS - 1; k++)
{
StaParams.supported_channels[j+1] =
StaParams.supported_channels[j] + wifi_chan_index;