psmattas/android_system_qcom-lineage
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

framework: Fix for 64-bit unsafe QCSAP_IOCTL_ASSOC_STA_MACADDR handling

Browse Source 
Fixes for making SAP SDK 64 bit compliant for QCSAP_IOCTL_ASSOC_STA_MACADDR
ioctl

Change-Id: I161ac3113c01752f627bd876f85342d5a9b20ede
CRs-Fixed: 639046
This commit is contained in:
Ravi Joshi
2014-04-02 16:18:12 -07:00
parent 1e7bd66054
commit 124fb55d96
1 changed files with 9 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
softap/sdk/qsap_api.c
View File

@@ -1463,6 +1463,7 @@ void qsap_get_associated_sta_mac(s8 *presp, u32 *plen)
u32 len = MAX_CONF_LINE_LEN;
s8 *pif;
s8 *pbuf, *pout;
u32 buflen;
u32 recvLen;
u32 tlen;
@@ -1482,7 +1483,9 @@ void qsap_get_associated_sta_mac(s8 *presp, u32 *plen)
goto error;
}
pbuf = (s8 *)malloc((MAX_STA_ALLOWED * 6) + 8);
/* response has length field + 6 bytes per STA */
buflen = sizeof(u32) + (MAX_STA_ALLOWED * 6);
pbuf = (s8 *)malloc(buflen);
if(NULL == pbuf) {
ALOGE("%s :No memory \n", __func__);
close(sock);
@@ -1492,7 +1495,7 @@ void qsap_get_associated_sta_mac(s8 *presp, u32 *plen)
#define SIZE_OF_MAC_INT (6)
strlcpy(wrq.ifr_name, pif, sizeof(wrq.ifr_name));
wrq.u.data.length = SIZE_OF_MAC_INT * 8 + 8; /** 8 supported MAC and 7 SPACE separators and a '\0' */
wrq.u.data.length = buflen;
wrq.u.data.pointer = (void *)pbuf;
wrq.u.data.flags = 0;
@@ -1504,13 +1507,14 @@ void qsap_get_associated_sta_mac(s8 *presp, u32 *plen)
goto error;
}
recvLen = *(unsigned long int *)(wrq.u.data.pointer);
recvLen = *(u32 *)(wrq.u.data.pointer);
recvLen -= sizeof(u32);
len = qsap_scnprintf(presp, *plen, "%s %s=", SUCCESS, cmd_list[eCMD_ASSOC_STA_MACS].name);
pout = presp + len;
tlen = *plen - len;
qsap_mac_to_macstr(pbuf+sizeof(unsigned long int), recvLen, pout, &tlen);
qsap_mac_to_macstr(pbuf+sizeof(u32), recvLen, pout, &tlen);
*plen = len + tlen;
@@ -3060,7 +3064,7 @@ int qsapsetSoftap(int argc, char *argv[])
{
char cmdbuf[CMD_BUF_LEN];
char respbuf[RECV_BUF_LEN];
unsigned long int rlen = RECV_BUF_LEN;
u32 rlen = RECV_BUF_LEN;
int i;
int hidden = 0;
int sec = SEC_MODE_NONE;