commit 84a92d13e2d8a4aa2932948356186a9937cee9c9
author guo-jie.wang <guo-jie.wang@mediatek.com> Fri Dec 15 11:14:02 2017 +0800
committer Guo-Jie Wang <guo-jie.wang@mediatek.com> Mon Dec 25 19:33:03 2017 +0800
tree d5b3092e6af0090750c30d71d336d3824a6b15c3
parent eff7341dd7b6a9bb73ab55ba2530abd2b0e9a8f4

[WCNCR00166525] misc: fix coverity issue

[Description]
Fix CID 2190583, 2190586 Out-of-bounds write

Change-Id: I4d9e3caf5f4ba5fe6a69ec2e68bff0da9945fef1
CR-Id: WCNCR00166525
Signed-off-by: guo-jie.wang <guo-jie.wang@mediatek.com>
Feature: misc
Reviewed-on: http://gerrit.mediatek.inc:8080/1252399
CheckPatch: Check Patch <srv_checkpatch@mediatek.com>
Reviewed-by: George Kuo <george.kuo@mediatek.com>
Reviewed-by: Sarick Jiang <sarick.jiang@mediatek.com>
Build: srv_neptune_adm <srv_neptune_adm@mediatek.com>

common/wlan_oid.c

diff --git a/common/wlan_oid.c b/common/wlan_oid.c
index 53c36c7..7fcbe8f 100644
--- a/common/wlan_oid.c
+++ b/common/wlan_oid.c
@@ -2547,6 +2547,12 @@
 					kalMemCopy(prCmdKey->aucPeerAddr, prBssInfo->aucOwnMacAddr, MAC_ADDR_LEN);
 				}
 
+				/* overflow check */
+				if (prCmdKey->ucKeyId >= MAX_KEY_NUM) {
+					DBGLOG(RSN, ERROR, "invalid keyId: %d\n", prCmdKey->ucKeyId);
+					prCmdKey->ucKeyId &= 0x3;
+				}
+
 				if (fgNoHandshakeSec) {	/* WEP: STA and AP */
 					prBssInfo->wepkeyWlanIdx = prCmdKey->ucWlanIndex;
 					prBssInfo->wepkeyUsed[prCmdKey->ucKeyId] = TRUE;
@@ -2559,6 +2565,7 @@
 					DBGLOG(RSN, INFO, "BMCWlanIndex kid = %d, index = %d\n", prCmdKey->ucKeyId,
 					       prCmdKey->ucWlanIndex);
 				}
+
 				if (prCmdKey->ucTxKey) {	/* */
 					prBssInfo->fgBcDefaultKeyExist = TRUE;
 					prBssInfo->ucBcDefaultKeyIdx = prCmdKey->ucKeyId;