diff options
| author | SaidiReddy Yenuga <saidir@codeaurora.org> | 2017-04-06 17:43:01 +0530 |
|---|---|---|
| committer | spuligil <spuligil@codeaurora.org> | 2017-04-15 12:49:44 -0700 |
| commit | 7a7637859576ec03080ef92f3c7887c219b6de2d (patch) | |
| tree | 43ede21a67e3b5f51cd4fafba75aab8cb34ca33b | |
| parent | 1398666fc764a69d1a68425c981bfe69a389971a (diff) | |
qcacld-3.0: Fix buffer over flow in hdd state ctrl
In hdd state ctrl API buf used beyond its size.
Increase buf size to 3 to get rid of buffer over flow.
CRs-fixed: 2029584
Change-Id: Ie353d449f167bee05833841350d61dc0935786fc
| -rw-r--r-- | core/hdd/src/wlan_hdd_main.c | 8 |
1 files changed, 4 insertions, 4 deletions
diff --git a/core/hdd/src/wlan_hdd_main.c b/core/hdd/src/wlan_hdd_main.c index 299d1caf928e..18ad9194fa52 100644 --- a/core/hdd/src/wlan_hdd_main.c +++ b/core/hdd/src/wlan_hdd_main.c @@ -9991,23 +9991,23 @@ static ssize_t wlan_hdd_state_ctrl_param_write(struct file *filp, size_t count, loff_t *f_pos) { - char buf; + char buf[3]; static const char wlan_off_str[] = "OFF"; static const char wlan_on_str[] = "ON"; int ret; unsigned long rc; - if (copy_from_user(&buf, user_buf, 3)) { + if (copy_from_user(buf, user_buf, 3)) { pr_err("Failed to read buffer\n"); return -EINVAL; } - if (strncmp(&buf, wlan_off_str, strlen(wlan_off_str)) == 0) { + if (strncmp(buf, wlan_off_str, strlen(wlan_off_str)) == 0) { pr_debug("Wifi turning off from UI\n"); goto exit; } - if (strncmp(&buf, wlan_on_str, strlen(wlan_on_str)) != 0) { + if (strncmp(buf, wlan_on_str, strlen(wlan_on_str)) != 0) { pr_err("Invalid value received from framework"); goto exit; } |