In the function wma_update_intf_hw_mode_params, vdev_id received from caller wma_pdev_set_hw_mode_resp_evt_handler, is used as the array index for wma->interfaces. If vdev_id exceeds wma->max_bssid then a possible OOB write could occur. Add check to validate vdev_id against wma->max_bssid. Print error if it exceeds. Change-Id: I3ddf5e1b24fbd2bd401ac879219300857d05e4b7 CRs-Fixed: 2243990 |
||
---|---|---|
.. | ||
inc | ||
src |