diff options
| author | Jeff Johnson <jjohnson@codeaurora.org> | 2016-11-18 08:04:08 -0800 |
|---|---|---|
| committer | Anjaneedevi Kapparapu <akappa@codeaurora.org> | 2016-11-24 14:42:41 +0530 |
| commit | bd9d2cf8a0194acc08656a5875cf131e56b68e17 (patch) | |
| tree | 9cd266fa8456777904fb21800955223635085dcb | |
| parent | 4aa3a5a0325faf5ec2ad57a21a46425af7f7f8d3 (diff) | |
qcacld-2.0: Validate "set passpoint list" network count
Currently when processing the "set passpoint list" vendor command the
"number of networks" parameter is not limit checked. This value is
subsequently used to calculate the size of a buffer. Add a limit check
to ensure that an appropriately sized buffer is always allocated.
Change-Id: Ibc2346b8a62898fc47e2d1efe457c57c08b0cada
CRs-Fixed: 1091940
| -rw-r--r-- | CORE/HDD/src/wlan_hdd_cfg80211.c | 7 | ||||
| -rw-r--r-- | CORE/MAC/inc/sirApi.h | 1 |
2 files changed, 7 insertions, 1 deletions
diff --git a/CORE/HDD/src/wlan_hdd_cfg80211.c b/CORE/HDD/src/wlan_hdd_cfg80211.c index 77a3ae9a3fe5..a2ff8feb2807 100644 --- a/CORE/HDD/src/wlan_hdd_cfg80211.c +++ b/CORE/HDD/src/wlan_hdd_cfg80211.c @@ -5246,8 +5246,13 @@ static int __wlan_hdd_cfg80211_set_passpoint_list(struct wiphy *wiphy, } num_networks = nla_get_u32( tb[QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_LIST_PARAM_NUM]); - hddLog(LOG1, FL("num networks %u"), num_networks); + if (num_networks > SIR_PASSPOINT_LIST_MAX_NETWORKS) { + hddLog(LOGE, FL("num networks %u exceeds max %u"), + num_networks, SIR_PASSPOINT_LIST_MAX_NETWORKS); + return -EINVAL; + } + hddLog(LOG1, FL("num networks %u"), num_networks); req_msg = vos_mem_malloc(sizeof(*req_msg) + (num_networks * sizeof(req_msg->networks[0]))); if (!req_msg) { diff --git a/CORE/MAC/inc/sirApi.h b/CORE/MAC/inc/sirApi.h index c5074d2042f2..fd0adb2ac148 100644 --- a/CORE/MAC/inc/sirApi.h +++ b/CORE/MAC/inc/sirApi.h @@ -5773,6 +5773,7 @@ struct wifi_epno_params struct wifi_epno_network networks[]; }; +#define SIR_PASSPOINT_LIST_MAX_NETWORKS 8 #define SIR_PASSPOINT_REALM_LEN 256 #define SIR_PASSPOINT_ROAMING_CONSORTIUM_ID_NUM 16 #define SIR_PASSPOINT_PLMN_LEN 3 |