diff options
| author | Jeff Johnson <jjohnson@codeaurora.org> | 2016-11-18 11:02:24 -0800 |
|---|---|---|
| committer | qcabuildsw <qcabuildsw@localhost> | 2016-11-21 16:49:49 -0800 |
| commit | fcb4dd8ea0d03dc1970c9b9ef8acc9e0327cd6e4 (patch) | |
| tree | a54ea9162f987ae2f38af64249022241985a4ebf | |
| parent | e6bea7849a75238aa05a8dc879202c44d2f048fb (diff) | |
qcacld-3.0: Validate "set passpoint list" network count
This is a qcacld-2.0 to qcacld-3.0 propagation.
Currently when processing the "set passpoint list" vendor command the
"number of networks" parameter is not limit checked. This value is
subsequently used to calculate the size of a buffer. Add a limit check
to ensure that an appropriately sized buffer is always allocated.
Change-Id: Ibc2346b8a62898fc47e2d1efe457c57c08b0cada
CRs-Fixed: 1091940
| -rw-r--r-- | core/hdd/src/wlan_hdd_ext_scan.c | 6 | ||||
| -rw-r--r-- | core/mac/inc/sir_api.h | 1 |
2 files changed, 7 insertions, 0 deletions
diff --git a/core/hdd/src/wlan_hdd_ext_scan.c b/core/hdd/src/wlan_hdd_ext_scan.c index 1a7cf50339f6..6515bd4c7b6b 100644 --- a/core/hdd/src/wlan_hdd_ext_scan.c +++ b/core/hdd/src/wlan_hdd_ext_scan.c @@ -4196,6 +4196,12 @@ static int __wlan_hdd_cfg80211_set_passpoint_list(struct wiphy *wiphy, } num_networks = nla_get_u32( tb[QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_LIST_PARAM_NUM]); + if (num_networks > SIR_PASSPOINT_LIST_MAX_NETWORKS) { + hdd_err("num networks %u exceeds max %u", + num_networks, SIR_PASSPOINT_LIST_MAX_NETWORKS); + return -EINVAL; + } + hdd_notice("num networks %u", num_networks); req_msg = qdf_mem_malloc(sizeof(*req_msg) + diff --git a/core/mac/inc/sir_api.h b/core/mac/inc/sir_api.h index 1cfcf4c1ac18..4791ea95c4eb 100644 --- a/core/mac/inc/sir_api.h +++ b/core/mac/inc/sir_api.h @@ -4749,6 +4749,7 @@ struct wifi_epno_params { struct wifi_epno_network networks[]; }; +#define SIR_PASSPOINT_LIST_MAX_NETWORKS 8 #define SIR_PASSPOINT_REALM_LEN 256 #define SIR_PASSPOINT_ROAMING_CONSORTIUM_ID_NUM 16 #define SIR_PASSPOINT_PLMN_LEN 3 |