commit 496e6ab2147ee8bae2aa93cdd13cab2f129079f4
author Ashwin <ashwin.bhat@broadcom.com> Tue Jul 07 14:25:55 2015 -0700
committer Vinit Deshpande <vinitd@google.com> Tue Jul 07 16:44:14 2015 -0700
tree 09e5651a2f02897d66a17917dde8fd8dbbff9daa
parent 289b89f3d370de773031f5fe15ec3cc03648a834

Fix for system crash caused by accessing memory w/o permissions

Fix a buffer overflow access that caused a SEGV_ACCERR

Change-Id: Id38ac0637696128ee66039e8b4c5e8d73ec945a1
Signed-off-by: Ashwin <ashwin.bhat@broadcom.com>

bcmdhd/wifi_hal/common.cpp

diff --git a/bcmdhd/wifi_hal/common.cpp b/bcmdhd/wifi_hal/common.cpp
index 9182114..fc81d61 100644
--- a/bcmdhd/wifi_hal/common.cpp
+++ b/bcmdhd/wifi_hal/common.cpp
@@ -213,7 +213,7 @@
     for (int i = 0; i < info->num_cmd; i++) {
         if (info->cmd[i].cmd == cmd) {
             int id = info->cmd[i].id;
-            memmove(&info->cmd[i], &info->cmd[i+1], (info->num_cmd - i) * sizeof(cmd_info));
+            memmove(&info->cmd[i], &info->cmd[i+1], (info->num_cmd - i - 1) * sizeof(cmd_info));
             info->num_cmd--;
             ALOGV("Successfully removed command %d: %p from %d", id, cmd, i);
             break;