diff options
| author | Mukul Sharma <mukul@codeaurora.org> | 2016-09-03 13:31:44 +0530 |
|---|---|---|
| committer | qcabuildsw <qcabuildsw@localhost> | 2016-09-10 19:05:54 -0700 |
| commit | dd93cbca9eac0aa27ba043036f46f8a3c016c58b (patch) | |
| tree | c00fc82bf2a5bccbcdee67bd7a6bf904e1f7b569 | |
| parent | e7ecb7cbb8f2fe5945d010c7d6473bfbf65a1f67 (diff) | |
qcacld-3.0: Prevent buffer overflow in QCSAP_IOCTL_VERSION
qcacld-2.0 to qcacld-3.0 propagation
The QCSAP_IOCTL_VERSION IOCTL is registered with a maximum GET
buffer length of QCSAP_MAX_SC_IE = 256 bytes. But while filling
buffer, Host allows to fill till WE_MAX_STR_LEN which may lead to
buffer overflow.
As a part of this fix, Host ensure to register with maximum
WE_MAX_STR_LEN buffer length.
Change-Id: I5ba0268e978c7ddadabc96a4eba18140ff7db3c6
CRs-Fixed: 1001142
(cherry picked from commit 85f4f75e8396e27467716555d68b3a18dd57b6fe)
| -rw-r--r-- | core/hdd/src/wlan_hdd_hostapd.c | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/core/hdd/src/wlan_hdd_hostapd.c b/core/hdd/src/wlan_hdd_hostapd.c index 5ec57b16fe29..d0d20dcf28cf 100644 --- a/core/hdd/src/wlan_hdd_hostapd.c +++ b/core/hdd/src/wlan_hdd_hostapd.c @@ -6035,7 +6035,7 @@ static const struct iw_priv_args hostapd_private_args[] = { QCSAP_IOCTL_STOPBSS, IW_PRIV_TYPE_BYTE | IW_PRIV_SIZE_FIXED, 0, "stopbss" }, { - QCSAP_IOCTL_VERSION, 0, IW_PRIV_TYPE_CHAR | QCSAP_MAX_WSC_IE, + QCSAP_IOCTL_VERSION, 0, IW_PRIV_TYPE_CHAR | WE_MAX_STR_LEN, "version" }, { QCSAP_IOCTL_GET_STA_INFO, 0, |