diff options
| author | Jeff Johnson <jjohnson@codeaurora.org> | 2016-11-02 11:34:12 -0700 |
|---|---|---|
| committer | qcabuildsw <qcabuildsw@localhost> | 2016-11-03 19:32:56 -0700 |
| commit | ce935a48be282b9a12bc7167ecfa06e5a148e72c (patch) | |
| tree | 73dae377d0206de041aa3a07f1470730f1dbe3ac | |
| parent | 2837390b583ee2bebb793c56884d06953cc0fc01 (diff) | |
qcacld-3.0: Properly validate the band in vendor scan command
Currently in __wlan_hdd_cfg80211_vendor_scan() the band parsed from
the QCA_WLAN_VENDOR_ATTR_SCAN_SUPP_RATES is not sufficiently validated
before being used. Validate the actual value before attempting to use
it as an index.
Change-Id: I0db43ab8e73e20c8cb60a75a521a934967615023
CRs-Fixed: 1085099
| -rw-r--r-- | core/hdd/src/wlan_hdd_scan.c | 15 |
1 files changed, 9 insertions, 6 deletions
diff --git a/core/hdd/src/wlan_hdd_scan.c b/core/hdd/src/wlan_hdd_scan.c index f955421b0ce6..f74c58fb99b0 100644 --- a/core/hdd/src/wlan_hdd_scan.c +++ b/core/hdd/src/wlan_hdd_scan.c @@ -2038,14 +2038,17 @@ static int __wlan_hdd_cfg80211_vendor_scan(struct wiphy *wiphy, if (tb[QCA_WLAN_VENDOR_ATTR_SCAN_SUPP_RATES]) { nla_for_each_nested(attr, - tb[QCA_WLAN_VENDOR_ATTR_SCAN_SUPP_RATES], - tmp) { + tb[QCA_WLAN_VENDOR_ATTR_SCAN_SUPP_RATES], + tmp) { band = nla_type(attr); + if (band >= NUM_NL80211_BANDS) + continue; if (!wiphy->bands[band]) continue; - request->rates[band] = wlan_hdd_get_rates(wiphy, - band, nla_data(attr), - nla_len(attr)); + request->rates[band] = + wlan_hdd_get_rates(wiphy, + band, nla_data(attr), + nla_len(attr)); } } @@ -2053,7 +2056,7 @@ static int __wlan_hdd_cfg80211_vendor_scan(struct wiphy *wiphy, request->flags = nla_get_u32(tb[QCA_WLAN_VENDOR_ATTR_SCAN_FLAGS]); if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) && - !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) { + !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) { hdd_err("LOW PRIORITY SCAN not supported"); goto error; } |