summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorAshwin <ashwin.bhat@broadcom.com>2015-07-07 14:25:55 -0700
committerVinit Deshpande <vinitd@google.com>2015-07-07 16:44:14 -0700
commit496e6ab2147ee8bae2aa93cdd13cab2f129079f4 (patch)
tree09e5651a2f02897d66a17917dde8fd8dbbff9daa
parent289b89f3d370de773031f5fe15ec3cc03648a834 (diff)
downloadhardware_broadcom_wlan-496e6ab2147ee8bae2aa93cdd13cab2f129079f4.zip
hardware_broadcom_wlan-496e6ab2147ee8bae2aa93cdd13cab2f129079f4.tar.gz
hardware_broadcom_wlan-496e6ab2147ee8bae2aa93cdd13cab2f129079f4.tar.bz2
Fix for system crash caused by accessing memory w/o permissions
Fix a buffer overflow access that caused a SEGV_ACCERR Change-Id: Id38ac0637696128ee66039e8b4c5e8d73ec945a1 Signed-off-by: Ashwin <ashwin.bhat@broadcom.com>
-rw-r--r--bcmdhd/wifi_hal/common.cpp2
1 files changed, 1 insertions, 1 deletions
diff --git a/bcmdhd/wifi_hal/common.cpp b/bcmdhd/wifi_hal/common.cpp
index 9182114..fc81d61 100644
--- a/bcmdhd/wifi_hal/common.cpp
+++ b/bcmdhd/wifi_hal/common.cpp
@@ -213,7 +213,7 @@ void wifi_unregister_cmd(wifi_handle handle, WifiCommand *cmd)
for (int i = 0; i < info->num_cmd; i++) {
if (info->cmd[i].cmd == cmd) {
int id = info->cmd[i].id;
- memmove(&info->cmd[i], &info->cmd[i+1], (info->num_cmd - i) * sizeof(cmd_info));
+ memmove(&info->cmd[i], &info->cmd[i+1], (info->num_cmd - i - 1) * sizeof(cmd_info));
info->num_cmd--;
ALOGV("Successfully removed command %d: %p from %d", id, cmd, i);
break;