diff options
| author | Pragaspathi Thilagaraj <tpragasp@codeaurora.org> | 2018-05-04 19:10:11 +0530 |
|---|---|---|
| committer | nshrivas <nshrivas@codeaurora.org> | 2018-05-04 14:06:14 -0700 |
| commit | 3537f1af08367a61b066ca4cbc237e72d52f7baf (patch) | |
| tree | 5135bf54696387eb1a7268e983940f69a2201866 | |
| parent | e276355654d46573068484744a26eae653b8c58c (diff) | |
qcacld-3.0: Fix possible buffer overread in wma_set_epno_network_list
In the function wma_set_epno_network_list,
req->networks[i].ssid.ssId is copied into the destination
params->networks[i].ssid.mac_ssid. But the ssid length is not
considered while copying and WMI_MAC_MAX_SSID_LENGTH is used as
the length for copying. This might result in possible buffer
overread if the ssid length is not WMI_MAC_MAX_SSID_LENGTH.
Similar issue is seen in wma_pno_start also.
Use pno->aNetworks[i].ssId.length as the size to mem copy the
ssid to the destination ssid buffer.
Change-Id: Id3f579da97e398663b7d583f5f46d4671eabeae3
CRs-Fixed: 2233682
| -rw-r--r-- | core/wma/src/wma_scan_roam.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/core/wma/src/wma_scan_roam.c b/core/wma/src/wma_scan_roam.c index 54b9619ca608..ba839090d750 100644 --- a/core/wma/src/wma_scan_roam.c +++ b/core/wma/src/wma_scan_roam.c @@ -3872,7 +3872,7 @@ QDF_STATUS wma_pno_start(tp_wma_handle wma, tpSirPNOScanReq pno) pno->aNetworks[i].ssId.length; qdf_mem_copy(params->aNetworks[i].ssid.mac_ssid, pno->aNetworks[i].ssId.ssId, - WMI_MAC_MAX_SSID_LENGTH); + pno->aNetworks[i].ssId.length); } params->enable_pno_scan_randomization = @@ -6360,7 +6360,7 @@ QDF_STATUS wma_set_epno_network_list(tp_wma_handle wma, req->networks[i].ssid.length; qdf_mem_copy(params->networks[i].ssid.mac_ssid, req->networks[i].ssid.ssId, - WMI_MAC_MAX_SSID_LENGTH); + req->networks[i].ssid.length); } } |