diff options
| author | SaidiReddy Yenuga <saidir@codeaurora.org> | 2016-09-21 13:44:35 +0530 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2016-11-02 19:19:51 -0700 |
| commit | 2837390b583ee2bebb793c56884d06953cc0fc01 (patch) | |
| tree | 291b42839b5faedd723a82a64e64c20e9386544b | |
| parent | 3487e4c895d26f5ade251fb1bb7767e0b4d87fb0 (diff) | |
qcacld-3.0: Add SSID length boundary check while processing vendor scan request
While extracting SSID from nl attributes, Currently there is
no boundary check for max and min length. Hence host causes
buffer overflow.
As a part of this fix, Add ssid array boundary check to avoid
buffer overflow.
CRs-Fixed: 1069298
Change-Id: I395be358f7bf3f23bb9453d1ed6c3dc9025f4aab
| -rw-r--r-- | core/hdd/src/wlan_hdd_scan.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/core/hdd/src/wlan_hdd_scan.c b/core/hdd/src/wlan_hdd_scan.c index 40b1e6f3b520..f955421b0ce6 100644 --- a/core/hdd/src/wlan_hdd_scan.c +++ b/core/hdd/src/wlan_hdd_scan.c @@ -2012,6 +2012,12 @@ static int __wlan_hdd_cfg80211_vendor_scan(struct wiphy *wiphy, nla_for_each_nested(attr, tb[QCA_WLAN_VENDOR_ATTR_SCAN_SSIDS], tmp) { request->ssids[count].ssid_len = nla_len(attr); + if (request->ssids[count].ssid_len > + SIR_MAC_MAX_SSID_LENGTH) { + hdd_err("SSID Len %d is not correct for network %d", + request->ssids[count].ssid_len, count); + goto error; + } memcpy(request->ssids[count].ssid, nla_data(attr), nla_len(attr)); count++; |