In function tdls_ct_idle_handler, idx is assigned from tdls_info->index which can be 0 254. But tdls_conn_info is static array in tdls_soc_priv_obj of size WLAN_TDLS_STA_MAX_NUM (8). So check idx is less than WLAN_TDLS_STA_MAX_NUM or not to avoid OOB memory access. Change-Id: I8387cb0a44a79f0f83b25c12de2aa9fbc39ab2f3 CRs-Fixed: 2474432 |
||
---|---|---|
.. | ||
core/src | ||
dispatcher |