In the function wma_set_epno_network_list, req->networks[i].ssid.ssId is copied into the destination params->networks[i].ssid.mac_ssid. But the ssid length is not considered while copying and WMI_MAC_MAX_SSID_LENGTH is used as the length for copying. This might result in possible buffer overread if the ssid length is not WMI_MAC_MAX_SSID_LENGTH. Similar issue is seen in wma_pno_start also. Use pno->aNetworks[i].ssId.length as the size to mem copy the ssid to the destination ssid buffer. Change-Id: Id3f579da97e398663b7d583f5f46d4671eabeae3 CRs-Fixed: 2233682 |
||
---|---|---|
.. | ||
bmi | ||
cds | ||
dp | ||
hdd | ||
mac | ||
pld | ||
sap | ||
sme | ||
wma |