diff options
| author | Srinivas Girigowda <sgirigow@codeaurora.org> | 2016-07-19 16:21:29 -0700 |
|---|---|---|
| committer | qcabuildsw <qcabuildsw@localhost> | 2016-10-12 01:25:06 -0700 |
| commit | 476deeb893c9917c2c2849ec5d57334fa59d2471 (patch) | |
| tree | 46e0dda7598a844d6f78faa3842a0d84313c06e2 | |
| parent | 0b18c45266361e0cd88be707b80e4ddb67b8b939 (diff) | |
qcacld-3.0: Fix buffer overwrite problem in CCXBEACONREQ
This is a propagation from qcacld-2.0 to qcacld-3.0.
Set the number of IE fields to minimum of input data and
SIR_ESE_MAX_MEAS_IE_REQS
Change-Id: Ie53cfec7872ab69530bbb8932f9f9e85fb319f92
CRs-Fixed: 993561
| -rw-r--r-- | core/hdd/src/wlan_hdd_ioctl.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/core/hdd/src/wlan_hdd_ioctl.c b/core/hdd/src/wlan_hdd_ioctl.c index 61c1a77aec74..a45115aa7185 100644 --- a/core/hdd/src/wlan_hdd_ioctl.c +++ b/core/hdd/src/wlan_hdd_ioctl.c @@ -2642,7 +2642,7 @@ static int hdd_parse_ese_beacon_req(uint8_t *pValue, if ('\0' == *inPtr) return -EINVAL; - /* get the first argument ie measurement token */ + /* Getting the first argument ie Number of IE fields */ v = sscanf(inPtr, "%31s ", buf); if (1 != v) return -EINVAL; @@ -2651,10 +2651,10 @@ static int hdd_parse_ese_beacon_req(uint8_t *pValue, if (v < 0) return -EINVAL; + tempInt = QDF_MIN(tempInt, SIR_ESE_MAX_MEAS_IE_REQS); pEseBcnReq->numBcnReqIe = tempInt; - hdd_info("Number of Bcn Req Ie fields(%d)", - pEseBcnReq->numBcnReqIe); + hdd_info("Number of Bcn Req Ie fields: %d", pEseBcnReq->numBcnReqIe); for (j = 0; j < (pEseBcnReq->numBcnReqIe); j++) { for (i = 0; i < 4; i++) { |