diff options
| author | Manjeet Singh <manjee@codeaurora.org> | 2016-11-09 19:11:01 +0530 |
|---|---|---|
| committer | qcabuildsw <qcabuildsw@localhost> | 2016-11-14 03:51:26 -0800 |
| commit | 7b2722eae417edcf2837049c5da9b1a2c15ba676 (patch) | |
| tree | e06b2974db18aa822f1e3c8b223b2db040a5cf16 | |
| parent | 699a0a1e527d3a56218dc200f040dc3313aae9f5 (diff) | |
qcacld-3.0: Validate extscan channel list size
In function __wlan_hdd_cfg80211_extscan_get_valid_channel,
Valid channel list length is limited to 100. But if the channel list size
in NL request buffer is larger, it can cause a buffer overflow situation
while filling the channel list in the request buffer.
Change-Id: Ie6226934af3e40817ef4b44007915c36e501fd56
CRs-Fixed: 1083022
| -rw-r--r-- | core/hdd/src/wlan_hdd_ext_scan.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/core/hdd/src/wlan_hdd_ext_scan.c b/core/hdd/src/wlan_hdd_ext_scan.c index 5140ad92c132..b389d4edd310 100644 --- a/core/hdd/src/wlan_hdd_ext_scan.c +++ b/core/hdd/src/wlan_hdd_ext_scan.c @@ -2549,6 +2549,13 @@ __wlan_hdd_cfg80211_extscan_get_valid_channels(struct wiphy *wiphy, maxChannels = nla_get_u32(tb [QCA_WLAN_VENDOR_ATTR_EXTSCAN_GET_VALID_CHANNELS_CONFIG_PARAM_MAX_CHANNELS]); + + if (maxChannels > WNI_CFG_VALID_CHANNEL_LIST_LEN) { + hdd_err("Max channels %d exceeded Valid channel list len %d", + maxChannels, WNI_CFG_VALID_CHANNEL_LIST_LEN); + return -EINVAL; + } + hdd_notice("Req Id: %u Wifi band: %d Max channels: %d", requestId, wifiBand, maxChannels); status = sme_get_valid_channels_by_band((tHalHandle) (pHddCtx->hHal), |