diff options
| author | Ecco park <eccopark@broadcom.com> | 2014-06-24 13:30:32 -0700 |
|---|---|---|
| committer | Dmitry Shmidt <dimitrysh@google.com> | 2014-06-24 14:36:43 -0700 |
| commit | 2054d939d57a838b0252faa179452c0ab37b9677 (patch) | |
| tree | cdf48509ee27cc93804af3402658426e7b723c16 /bcmdhd/wpa_supplicant_8_lib | |
| parent | bcd905af9e0c40e7c4bf2e6390fc3374a7a261f7 (diff) | |
| download | hardware_broadcom_wlan-2054d939d57a838b0252faa179452c0ab37b9677.zip hardware_broadcom_wlan-2054d939d57a838b0252faa179452c0ab37b9677.tar.gz hardware_broadcom_wlan-2054d939d57a838b0252faa179452c0ab37b9677.tar.bz2 | |
bcmdhd: Allocate memory dynamically in wpa_driver_set_ap_wps_p2p_ie()
Bug: 15695771
Change-Id: I86bc9cb5f6b1e712c62185d82f59d08b2b6cd2a8
Signed-off-by: Ecco park <eccopark@broadcom.com>
Signed-off-by: Dmitry Shmidt <dimitrysh@google.com>
Diffstat (limited to 'bcmdhd/wpa_supplicant_8_lib')
| -rw-r--r-- | bcmdhd/wpa_supplicant_8_lib/driver_cmd_nl80211.c | 38 |
1 files changed, 23 insertions, 15 deletions
diff --git a/bcmdhd/wpa_supplicant_8_lib/driver_cmd_nl80211.c b/bcmdhd/wpa_supplicant_8_lib/driver_cmd_nl80211.c index 064654e..43695f4 100644 --- a/bcmdhd/wpa_supplicant_8_lib/driver_cmd_nl80211.c +++ b/bcmdhd/wpa_supplicant_8_lib/driver_cmd_nl80211.c @@ -18,7 +18,6 @@ #include "android_drv.h" #endif -#define MAX_WPSP2PIE_CMD_SIZE 512 typedef struct android_wifi_priv_cmd { #ifdef BCMDHD_64_BIT_IPC @@ -164,12 +163,13 @@ int wpa_driver_set_ap_wps_p2p_ie(void *priv, const struct wpabuf *beacon, const struct wpabuf *proberesp, const struct wpabuf *assocresp) { - char buf[MAX_WPSP2PIE_CMD_SIZE]; - struct wpabuf *ap_wps_p2p_ie = NULL; + char *buf; + const struct wpabuf *ap_wps_p2p_ie = NULL; + char *_cmd = "SET_AP_WPS_P2P_IE"; char *pbuf; int ret = 0; - int i; + int i, buf_len; struct cmd_desc { int cmd; const struct wpabuf *src; @@ -182,20 +182,28 @@ int wpa_driver_set_ap_wps_p2p_ie(void *priv, const struct wpabuf *beacon, wpa_printf(MSG_DEBUG, "%s: Entry", __func__); for (i = 0; cmd_arr[i].cmd != -1; i++) { - os_memset(buf, 0, sizeof(buf)); - pbuf = buf; - pbuf += sprintf(pbuf, "%s %d", _cmd, cmd_arr[i].cmd); - *pbuf++ = '\0'; - ap_wps_p2p_ie = cmd_arr[i].src ? - wpabuf_dup(cmd_arr[i].src) : NULL; + ap_wps_p2p_ie = cmd_arr[i].src ? cmd_arr[i].src : NULL; if (ap_wps_p2p_ie) { - os_memcpy(pbuf, wpabuf_head(ap_wps_p2p_ie), wpabuf_len(ap_wps_p2p_ie)); - ret = wpa_driver_nl80211_driver_cmd(priv, buf, buf, - strlen(_cmd) + 3 + wpabuf_len(ap_wps_p2p_ie)); - wpabuf_free(ap_wps_p2p_ie); - if (ret < 0) + buf_len = strlen(_cmd) + 3 + wpabuf_len(ap_wps_p2p_ie); + buf = os_zalloc(buf_len); + if (NULL == buf) { + wpa_printf(MSG_ERROR, "%s: Out of memory", + __func__); + ret = -1; break; + } + } else { + continue; } + pbuf = buf; + pbuf += snprintf(pbuf, buf_len - wpabuf_len(ap_wps_p2p_ie), + "%s %d",_cmd, cmd_arr[i].cmd); + *pbuf++ = '\0'; + os_memcpy(pbuf, wpabuf_head(ap_wps_p2p_ie), wpabuf_len(ap_wps_p2p_ie)); + ret = wpa_driver_nl80211_driver_cmd(priv, buf, buf, buf_len); + os_free(buf); + if (ret < 0) + break; } return ret; |