diff options
| author | Ashwin <ashwin.bhat@broadcom.com> | 2015-07-07 14:25:55 -0700 |
|---|---|---|
| committer | Vinit Deshpande <vinitd@google.com> | 2015-07-07 16:44:14 -0700 |
| commit | 496e6ab2147ee8bae2aa93cdd13cab2f129079f4 (patch) | |
| tree | 09e5651a2f02897d66a17917dde8fd8dbbff9daa | |
| parent | 289b89f3d370de773031f5fe15ec3cc03648a834 (diff) | |
| download | hardware_broadcom_wlan-496e6ab2147ee8bae2aa93cdd13cab2f129079f4.zip hardware_broadcom_wlan-496e6ab2147ee8bae2aa93cdd13cab2f129079f4.tar.gz hardware_broadcom_wlan-496e6ab2147ee8bae2aa93cdd13cab2f129079f4.tar.bz2 | |
Fix for system crash caused by accessing memory w/o permissions
Fix a buffer overflow access that caused a SEGV_ACCERR
Change-Id: Id38ac0637696128ee66039e8b4c5e8d73ec945a1
Signed-off-by: Ashwin <ashwin.bhat@broadcom.com>
| -rw-r--r-- | bcmdhd/wifi_hal/common.cpp | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/bcmdhd/wifi_hal/common.cpp b/bcmdhd/wifi_hal/common.cpp index 9182114..fc81d61 100644 --- a/bcmdhd/wifi_hal/common.cpp +++ b/bcmdhd/wifi_hal/common.cpp @@ -213,7 +213,7 @@ void wifi_unregister_cmd(wifi_handle handle, WifiCommand *cmd) for (int i = 0; i < info->num_cmd; i++) { if (info->cmd[i].cmd == cmd) { int id = info->cmd[i].id; - memmove(&info->cmd[i], &info->cmd[i+1], (info->num_cmd - i) * sizeof(cmd_info)); + memmove(&info->cmd[i], &info->cmd[i+1], (info->num_cmd - i - 1) * sizeof(cmd_info)); info->num_cmd--; ALOGV("Successfully removed command %d: %p from %d", id, cmd, i); break; |