In the API csr_roam_roaming_state_reassoc_rsp_processor the driver extracts pNeighborRoamInfo from pMac, but it may happen the session id is greater than CSR_ROAM_SESSION_MAX which results in a out of bound access of memory. Fix is to have a max check of session ID and then extract pNeighborRoamInfo from that session. Change-Id: If3fb98fa278562abe40137ffead8ff4f85b40b1f CRs-Fixed: 2259229 |
||
---|---|---|
.. | ||
inc | ||
src |