diff options
| author | Yingying Tang <yintang@qti.qualcomm.com> | 2016-03-04 18:14:03 +0800 |
|---|---|---|
| committer | Anjaneedevi Kapparapu <akappa@codeaurora.org> | 2016-03-24 13:35:26 +0530 |
| commit | 55072f269d2431b40f55bf581e09a674684fa99a (patch) | |
| tree | a7b55bbb9008c43ae27b6d571b0900ac7a8ec41b | |
| parent | 373b46cf87e50188abbac90becf7d2855fb8e062 (diff) | |
qcacld-2.0: Fix the variable length limitaion in iw_softap_setwpsie()
In iw_softap_setwpsie(), the variable length limitation is incomplete,
add fix to correct it.
Change-Id: I325655709171fe09805d617ed07f73dab38bd6f7
CRs-Fixed: 979671
| -rw-r--r-- | CORE/HDD/src/wlan_hdd_hostapd.c | 9 |
1 files changed, 7 insertions, 2 deletions
diff --git a/CORE/HDD/src/wlan_hdd_hostapd.c b/CORE/HDD/src/wlan_hdd_hostapd.c index 7d711851ec92..eba98804a719 100644 --- a/CORE/HDD/src/wlan_hdd_hostapd.c +++ b/CORE/HDD/src/wlan_hdd_hostapd.c @@ -115,6 +115,9 @@ extern int process_wma_set_command(int sessid, int paramid, #define SAP_24GHZ_CH_COUNT (14) #define ACS_SCAN_EXPIRY_TIMEOUT_S 4 +/* EID byte + length byte + four byte WiFi OUI */ +#define DOT11F_EID_HEADER_LEN (6) + /*--------------------------------------------------------------------------- * Function definitions *-------------------------------------------------------------------------*/ @@ -5315,7 +5318,8 @@ static int __iw_softap_setwpsie(struct net_device *dev, switch ( wps_genie[0] ) { case DOT11F_EID_WPA: - if (wps_genie[1] < 2 + 4) + if (wps_genie[1] < DOT11F_EID_HEADER_LEN || + wps_genie[1] > DOT11F_IE_WPA_MAX_LEN + DOT11F_EID_HEADER_LEN) { ret = -EINVAL; goto exit; @@ -5419,7 +5423,8 @@ static int __iw_softap_setwpsie(struct net_device *dev, switch ( wps_genie[0] ) { case DOT11F_EID_WPA: - if (wps_genie[1] < 2 + 4) + if (wps_genie[1] < DOT11F_EID_HEADER_LEN || + wps_genie[1] > DOT11F_IE_WPA_MAX_LEN + DOT11F_EID_HEADER_LEN) { ret = -EINVAL; goto exit; |