diff options
| -rw-r--r-- | core/hdd/src/wlan_hdd_assoc.c | 9 |
1 files changed, 8 insertions, 1 deletions
diff --git a/core/hdd/src/wlan_hdd_assoc.c b/core/hdd/src/wlan_hdd_assoc.c index cb5183af4ab0..2254c4a7e916 100644 --- a/core/hdd/src/wlan_hdd_assoc.c +++ b/core/hdd/src/wlan_hdd_assoc.c @@ -6271,7 +6271,14 @@ static int __iw_set_essid(struct net_device *dev, } #endif /* FEATURE_WLAN_WAPI */ /* if previous genIE is not NULL, update AssocIE */ - if (0 != pWextState->genIE.length) { + if (pWextState->genIE.length != 0) { + if (pWextState->genIE.length > + (SIR_MAC_MAX_ADD_IE_LENGTH + 2)) { + hdd_err("genIE length exceeds the maximum value: %d", + pWextState->genIE.length); + return -EINVAL; + } + memset(&pWextState->assocAddIE, 0, sizeof(pWextState->assocAddIE)); memcpy(pWextState->assocAddIE.addIEdata, |