diff options
| author | Min Liu <minliu@codeaurora.org> | 2018-01-08 22:26:33 +0800 |
|---|---|---|
| committer | snandini <snandini@codeaurora.org> | 2018-01-10 22:01:02 -0800 |
| commit | 25107be39095bafb8771e270ccfddaaf0e157c07 (patch) | |
| tree | 8de538939a7bbcc0deccee20723e0f42f469d629 | |
| parent | 7a94f7a6dc4c51307ba54ff61144e06f09a5ce52 (diff) | |
qcacld-2.0: Add string length validation
In hdd_parse_get_ibss_peer_info(), issue is reported by external
researcher that lack of string length validation might lead to
out-of-bounds read.
Related string length validation is added accordingly.
Change-Id: If04cc77b5fca782094dc577b21e1537dfe783282
CRs-Fixed: 2101686
| -rw-r--r-- | CORE/HDD/src/wlan_hdd_main.c | 10 |
1 files changed, 9 insertions, 1 deletions
diff --git a/CORE/HDD/src/wlan_hdd_main.c b/CORE/HDD/src/wlan_hdd_main.c index ac07b9cf4738..75b872b28a81 100644 --- a/CORE/HDD/src/wlan_hdd_main.c +++ b/CORE/HDD/src/wlan_hdd_main.c @@ -1718,7 +1718,9 @@ static VOS_STATUS hdd_parse_get_ibss_peer_info(tANI_U8 *pValue, v_MACADDR_t *pPeerMacAddr) { tANI_U8 *inPtr = pValue; - inPtr = strnchr(pValue, strlen(pValue), SPACE_ASCII_VALUE); + size_t inPtrLen = strlen(pValue); + + inPtr = strnchr(pValue, inPtrLen, SPACE_ASCII_VALUE); if (NULL == inPtr) { @@ -1737,6 +1739,12 @@ hdd_parse_get_ibss_peer_info(tANI_U8 *pValue, v_MACADDR_t *pPeerMacAddr) return VOS_STATUS_E_FAILURE;; } + inPtrLen -= (inPtr - pValue); + if (inPtrLen < 17) + { + return VOS_STATUS_E_FAILURE; + } + if (inPtr[2] != ':' || inPtr[5] != ':' || inPtr[8] != ':' || inPtr[11] != ':' || inPtr[14] != ':') { |