diff options
| author | Srinivas Girigowda <sgirigow@qca.qualcomm.com> | 2015-08-02 09:50:01 -0700 |
|---|---|---|
| committer | Anjaneedevi Kapparapu <akappa@codeaurora.org> | 2015-08-03 15:39:45 +0530 |
| commit | 46cb2b1f9bbba6379089cb4725cb40c04e5e4b35 (patch) | |
| tree | ddd94ff977f6ad37542888ade9c93c6c7849bcd8 | |
| parent | c0dcf26fe31bcb7ce900f6f739500f9db52a6ee0 (diff) | |
qcacld-2.0: Fix buffer overwrite problem in RSSI
If (len + 1) is greater than priv_data.total_len then copy_to_user
results in writing more data than the buffer can hold.
Fix this by writing mininum of (len + 1) and priv_data.total_len
Change-Id: I2fd466bcbd648a8257682eb51e1d355b5127ead4
CRs-Fixed: 883386
| -rwxr-xr-x | CORE/HDD/src/wlan_hdd_main.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/CORE/HDD/src/wlan_hdd_main.c b/CORE/HDD/src/wlan_hdd_main.c index c7348b121963..db9f98f2730d 100755 --- a/CORE/HDD/src/wlan_hdd_main.c +++ b/CORE/HDD/src/wlan_hdd_main.c @@ -6043,7 +6043,8 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter, wlan_hdd_get_rssi(pAdapter, &s7Rssi); len = scnprintf(extra, sizeof(extra), "%s %d", command, s7Rssi); - if (copy_to_user(priv_data.buf, &extra, len + 1)) { + len = VOS_MIN(priv_data.total_len, len + 1); + if (copy_to_user(priv_data.buf, &extra, len)) { hddLog(LOGE, FL("Failed to copy data to user buffer")); ret = -EFAULT; goto exit; |