diff options
| author | Manjeet Singh <manjee@codeaurora.org> | 2017-01-03 12:08:10 +0530 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-01-06 20:56:14 -0800 |
| commit | a2959858f428acfca3ca4c61d3c10b446bfe9b60 (patch) | |
| tree | 732d360e2fe95c095235b3882afe9cd26ff52938 | |
| parent | d75d26ac990ec80e32cb813a70a2f90b04b4330e (diff) | |
qcacld-3.0: Add buf len check in wlan_hdd_cfg80211_testmode
qcacld-2.0 to qcacld-3.0 propagation.
In __wlan_hdd_cfg80211_testmode API no checks are in place that
ensure that buflen is smaller or equal the size of the stack
variable hb_params. Hence, the vos_mem_copy() call can overflow
stack memory.
Add buf len check to avoid stack overflow
CRs-Fixed: 1105085
Change-Id: I6af6a74cc38ebce3337120adcf7e9595f22d3d8c
| -rw-r--r-- | core/hdd/src/wlan_hdd_cfg80211.c | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/core/hdd/src/wlan_hdd_cfg80211.c b/core/hdd/src/wlan_hdd_cfg80211.c index 98b00122ff11..1f34e4cce4f7 100644 --- a/core/hdd/src/wlan_hdd_cfg80211.c +++ b/core/hdd/src/wlan_hdd_cfg80211.c @@ -14974,6 +14974,12 @@ static int __wlan_hdd_cfg80211_testmode(struct wiphy *wiphy, timePeriodSec == 0)) return -EINVAL; + if (buf_len > sizeof(*hb_params)) { + hdd_err("buf_len=%d exceeded hb_params size limit", + buf_len); + return -ERANGE; + } + hb_params = (tSirLPHBReq *) qdf_mem_malloc(sizeof(tSirLPHBReq)); if (NULL == hb_params) { |