From bd1ad03c3de7716135569a186d9e28e9178de74a Mon Sep 17 00:00:00 2001 From: Vignesh Viswanathan Date: Wed, 15 Nov 2017 15:13:56 +0530 Subject: [PATCH] qcacld-3.0: Fix check for peer_num in wma_get_ll_stats_ext_buf The current check for peer_num in wma_get_ll_stats_ext_buf is incorrect and subtracts total_peer_len from WMI_SVC_MSG_MAX_SIZE and then divides it by the size of peer stats struct. Fix the check in such a way that peer num is not greater than WMI_SVC_MSG_MAX_SIZE divided by the sum of total_peer_len and size of peer stats struct. Change-Id: Idd21852052b14e9b30785f2ac4acbd172dd923ef CRs-Fixed: 2143891 --- core/wma/src/wma_utils.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/core/wma/src/wma_utils.c b/core/wma/src/wma_utils.c index 1008fa2d6b97a..2a1f02900260c 100644 --- a/core/wma/src/wma_utils.c +++ b/core/wma/src/wma_utils.c @@ -771,8 +771,8 @@ static tSirLLStatsResults *wma_get_ll_stats_ext_buf(uint32_t *len, excess_data = true; break; } - if (peer_num > (WMI_SVC_MSG_MAX_SIZE - total_peer_len) / - sizeof(struct sir_wifi_ll_ext_peer_stats)) { + if (peer_num > WMI_SVC_MSG_MAX_SIZE / (total_peer_len + + sizeof(struct sir_wifi_ll_ext_peer_stats))) { excess_data = true; break; } else {