psmattas/android_system_qcom-lineage
Archived
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

framework: Fix for 64-bit unsafe QCSAP_IOCTL_ASSOC_STA_MACADDR handling

Browse Source 
Fixes for making SAP SDK 64 bit compliant for QCSAP_IOCTL_ASSOC_STA_MACADDR
ioctl

Change-Id: I161ac3113c01752f627bd876f85342d5a9b20ede
CRs-Fixed: 639046
This commit is contained in:
Ravi Joshi
2014-04-02 16:18:12 -07:00
parent 1e7bd66054
commit 124fb55d96
1 changed files with 9 additions and 5 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
softap/sdk/qsap_api.c
View File

@@ -1463,6 +1463,7 @@ void qsap_get_associated_sta_mac(s8 *presp, u32 *plen)
u32 len = MAX_CONF_LINE_LEN; u32 len = MAX_CONF_LINE_LEN;
s8 *pif; s8 *pif;
s8 *pbuf, *pout; s8 *pbuf, *pout;
u32 buflen;
u32 recvLen; u32 recvLen;
u32 tlen; u32 tlen;
@@ -1482,7 +1483,9 @@ void qsap_get_associated_sta_mac(s8 *presp, u32 *plen)
goto error; goto error;
} }
pbuf = (s8 *)malloc((MAX_STA_ALLOWED * 6) + 8); /* response has length field + 6 bytes per STA */
buflen = sizeof(u32) + (MAX_STA_ALLOWED * 6);
pbuf = (s8 *)malloc(buflen);
if(NULL == pbuf) { if(NULL == pbuf) {
ALOGE("%s :No memory \n", __func__); ALOGE("%s :No memory \n", __func__);
close(sock); close(sock);
@@ -1492,7 +1495,7 @@ void qsap_get_associated_sta_mac(s8 *presp, u32 *plen)
#define SIZE_OF_MAC_INT (6) #define SIZE_OF_MAC_INT (6)
strlcpy(wrq.ifr_name, pif, sizeof(wrq.ifr_name)); strlcpy(wrq.ifr_name, pif, sizeof(wrq.ifr_name));
wrq.u.data.length = SIZE_OF_MAC_INT * 8 + 8; /** 8 supported MAC and 7 SPACE separators and a '\0' */ wrq.u.data.length = buflen;
wrq.u.data.pointer = (void *)pbuf; wrq.u.data.pointer = (void *)pbuf;
wrq.u.data.flags = 0; wrq.u.data.flags = 0;
@@ -1504,13 +1507,14 @@ void qsap_get_associated_sta_mac(s8 *presp, u32 *plen)
goto error; goto error;
} }
recvLen = *(unsigned long int *)(wrq.u.data.pointer); recvLen = *(u32 *)(wrq.u.data.pointer);
recvLen -= sizeof(u32);
len = qsap_scnprintf(presp, *plen, "%s %s=", SUCCESS, cmd_list[eCMD_ASSOC_STA_MACS].name); len = qsap_scnprintf(presp, *plen, "%s %s=", SUCCESS, cmd_list[eCMD_ASSOC_STA_MACS].name);
pout = presp + len; pout = presp + len;
tlen = *plen - len; tlen = *plen - len;
qsap_mac_to_macstr(pbuf+sizeof(unsigned long int), recvLen, pout, &tlen); qsap_mac_to_macstr(pbuf+sizeof(u32), recvLen, pout, &tlen);
*plen = len + tlen; *plen = len + tlen;
@@ -3060,7 +3064,7 @@ int qsapsetSoftap(int argc, char *argv[])
{ {
char cmdbuf[CMD_BUF_LEN]; char cmdbuf[CMD_BUF_LEN];
char respbuf[RECV_BUF_LEN]; char respbuf[RECV_BUF_LEN];
unsigned long int rlen = RECV_BUF_LEN; u32 rlen = RECV_BUF_LEN;
int i; int i;
int hidden = 0; int hidden = 0;
int sec = SEC_MODE_NONE; int sec = SEC_MODE_NONE;