diff options
| author | Hanumanth Reddy Pothula <c_hpothu@codeaurora.org> | 2018-05-04 15:26:02 +0530 |
|---|---|---|
| committer | nshrivas <nshrivas@codeaurora.org> | 2018-05-15 03:12:07 -0700 |
| commit | 3a33ec69bcc325f9d474b9bd338ac11f14cf4e00 (patch) | |
| tree | 08a32443fc5412c0ab9abe7ff54d09aed4f299bc | |
| parent | b809b3936bc735627ec416f7e3092ceb162c845d (diff) | |
qcacld-3.0: Avoid buffer overread while processing set pno IOCTL
While processing set pno IOCTL, input argument 'extra' is printed
without making sure it's NULL terminated.
Log input string 'extra' after making sure it's NULL terminated.
Change-Id: I4158103a85c0828dad240cf00b34da94e6a8cc62
CRs-Fixed: 2228601
| -rw-r--r-- | core/hdd/src/wlan_hdd_wext.c | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/core/hdd/src/wlan_hdd_wext.c b/core/hdd/src/wlan_hdd_wext.c index c437a58fdfc9..6925d0eeb2dd 100644 --- a/core/hdd/src/wlan_hdd_wext.c +++ b/core/hdd/src/wlan_hdd_wext.c @@ -11711,8 +11711,6 @@ static int __iw_set_pno(struct net_device *dev, if (ret) return ret; - hdd_debug("PNO data len %d data %s", wrqu->data.length, extra); - /* making sure argument string ends with '\0' */ len = (wrqu->data.length + 1); data = qdf_mem_malloc(len); @@ -11724,6 +11722,8 @@ static int __iw_set_pno(struct net_device *dev, qdf_mem_copy(data, extra, (len-1)); ptr = data; + hdd_debug("PNO data len %d data %s", wrqu->data.length, data); + request.enable = 0; request.ucNetworksCount = 0; |