diff options
| author | Srinivas Girigowda <sgirigow@qca.qualcomm.com> | 2016-04-10 00:35:17 -0700 |
|---|---|---|
| committer | Anjaneedevi Kapparapu <akappa@codeaurora.org> | 2016-04-13 10:13:31 +0530 |
| commit | fdda9c0af64d6e5cdf006e2d8dd57e655821a962 (patch) | |
| tree | e2e19690e0b9d826937a11e0f914d066899f9018 | |
| parent | 29007df7f0b904e497f37e9b691a439cf1047fc6 (diff) | |
qcacld-2.0: Fix buffer overwrite problem in CCXPLMREQ
Set the number of channels to minimum of input data and
WNI_CFG_VALID_CHANNEL_LIST_LEN.
Change-Id: Ib6fca483ac99cddfcd3b739ce62e86ecd498f1f5
CRs-Fixed: 1001450
| -rw-r--r-- | CORE/HDD/src/wlan_hdd_main.c | 14 |
1 files changed, 7 insertions, 7 deletions
diff --git a/CORE/HDD/src/wlan_hdd_main.c b/CORE/HDD/src/wlan_hdd_main.c index a6249e15d7ed..38452eb4a504 100644 --- a/CORE/HDD/src/wlan_hdd_main.c +++ b/CORE/HDD/src/wlan_hdd_main.c @@ -3002,8 +3002,9 @@ static eHalStatus hdd_parse_plm_cmd(tANI_U8 *pValue, tSirPlmReq *pPlmRequest) if (content < 0) return eHAL_STATUS_FAILURE; + content = VOS_MIN(content, WNI_CFG_VALID_CHANNEL_LIST_LEN); pPlmRequest->plmNumCh = content; - hddLog(VOS_TRACE_LEVEL_DEBUG, "numch %d", pPlmRequest->plmNumCh); + hddLog(LOG1, FL("Numch: %d"), pPlmRequest->plmNumCh); /* Channel numbers */ for (count = 0; count < pPlmRequest->plmNumCh; count++) @@ -3021,10 +3022,9 @@ static eHalStatus hdd_parse_plm_cmd(tANI_U8 *pValue, tSirPlmReq *pPlmRequest) if (1 != ret) return eHAL_STATUS_FAILURE; ret = kstrtos32(buf, 10, &content); - if ( ret < 0) return eHAL_STATUS_FAILURE; - - if (content <= 0) - return eHAL_STATUS_FAILURE; + if (ret < 0 || content <= 0 || + content > WNI_CFG_CURRENT_CHANNEL_STAMAX) + return eHAL_STATUS_FAILURE; pPlmRequest->plmChList[count]= content; hddLog(VOS_TRACE_LEVEL_DEBUG, " ch- %d", @@ -6464,11 +6464,11 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter, { tANI_U8 *value = command; eHalStatus status = eHAL_STATUS_SUCCESS; - tpSirPlmReq pPlmRequest = NULL; + tpSirPlmReq pPlmRequest; pPlmRequest = vos_mem_malloc(sizeof(tSirPlmReq)); if (NULL == pPlmRequest){ - ret = -EINVAL; + ret = -ENOMEM; goto exit; } |