diff options
| author | Srinivas Girigowda <sgirigow@codeaurora.org> | 2016-08-26 14:53:59 -0700 |
|---|---|---|
| committer | qcabuildsw <qcabuildsw@localhost> | 2016-10-17 21:53:06 -0700 |
| commit | 0fb6cc4dde6e44907cd85f9c33e09f78592a9c12 (patch) | |
| tree | 2b89d25ad0a6a995d0d0a7c0ca3cfdd3d74ec287 | |
| parent | 0ee96441f425b1c4eaac96841259e09ef11a11c9 (diff) | |
qcacld-3.0: Fix buffer overwrite problem in CCXPLMREQ
This is a qcacld-2.0 to qcacld-3.0 propagation.
Set the number of channels to minimum of input data and
WNI_CFG_VALID_CHANNEL_LIST_LEN.
Change-Id: Ib6fca483ac99cddfcd3b739ce62e86ecd498f1f5
CRs-Fixed: 1001450
| -rw-r--r-- | core/hdd/src/wlan_hdd_ioctl.c | 9 |
1 files changed, 4 insertions, 5 deletions
diff --git a/core/hdd/src/wlan_hdd_ioctl.c b/core/hdd/src/wlan_hdd_ioctl.c index fd4def55ed73..775ec138633e 100644 --- a/core/hdd/src/wlan_hdd_ioctl.c +++ b/core/hdd/src/wlan_hdd_ioctl.c @@ -1863,8 +1863,9 @@ QDF_STATUS hdd_parse_plm_cmd(uint8_t *pValue, tSirPlmReq *pPlmRequest) if (content < 0) return QDF_STATUS_E_FAILURE; + content = QDF_MIN(content, WNI_CFG_VALID_CHANNEL_LIST_LEN); pPlmRequest->plmNumCh = content; - hdd_debug("numch %d", pPlmRequest->plmNumCh); + hdd_debug("numch: %d", pPlmRequest->plmNumCh); /* Channel numbers */ for (count = 0; count < pPlmRequest->plmNumCh; count++) { @@ -1883,10 +1884,8 @@ QDF_STATUS hdd_parse_plm_cmd(uint8_t *pValue, tSirPlmReq *pPlmRequest) return QDF_STATUS_E_FAILURE; ret = kstrtos32(buf, 10, &content); - if (ret < 0) - return QDF_STATUS_E_FAILURE; - - if (content <= 0) + if (ret < 0 || content <= 0 || + content > WNI_CFG_CURRENT_CHANNEL_STAMAX) return QDF_STATUS_E_FAILURE; pPlmRequest->plmChList[count] = content; |