diff options
| -rw-r--r-- | CORE/HDD/src/wlan_hdd_cfg80211.c | 16 | ||||
| -rw-r--r-- | CORE/SERVICES/WMA/wma.c | 4 |
2 files changed, 18 insertions, 2 deletions
diff --git a/CORE/HDD/src/wlan_hdd_cfg80211.c b/CORE/HDD/src/wlan_hdd_cfg80211.c index d91859fba7dc..1991204c9102 100644 --- a/CORE/HDD/src/wlan_hdd_cfg80211.c +++ b/CORE/HDD/src/wlan_hdd_cfg80211.c @@ -2893,6 +2893,11 @@ static int __wlan_hdd_cfg80211_extscan_set_bssid_hotlist(struct wiphy *wiphy, } pReqMsg->numAp = nla_get_u32( tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_BSSID_HOTLIST_PARAMS_NUM_AP]); + if (pReqMsg->numAp > WLAN_EXTSCAN_MAX_HOTLIST_APS) { + hddLog(LOGE, FL("Number of AP: %u exceeds max: %u"), + pReqMsg->numAp, WLAN_EXTSCAN_MAX_HOTLIST_APS); + goto fail; + } hddLog(LOG1, FL("Number of AP %d"), pReqMsg->numAp); /* Parse and fetch lost ap sample size */ @@ -2911,6 +2916,11 @@ static int __wlan_hdd_cfg80211_extscan_set_bssid_hotlist(struct wiphy *wiphy, i = 0; nla_for_each_nested(apTh, tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_AP_THRESHOLD_PARAM], rem) { + if (i == pReqMsg->numAp) { + hddLog(LOGW, FL("Ignoring excess AP")); + break; + } + if (nla_parse(tb2, QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX, nla_data(apTh), nla_len(apTh), wlan_hdd_extscan_config_policy)) { @@ -2949,6 +2959,12 @@ static int __wlan_hdd_cfg80211_extscan_set_bssid_hotlist(struct wiphy *wiphy, i++; } + if (i < pReqMsg->numAp) { + hddLog(LOGW, FL("Number of AP %u less than expected %u"), + i, pReqMsg->numAp); + pReqMsg->numAp = i; + } + context = &pHddCtx->ext_scan_context; spin_lock(&hdd_context_lock); INIT_COMPLETION(context->response_event); diff --git a/CORE/SERVICES/WMA/wma.c b/CORE/SERVICES/WMA/wma.c index 2cf66bf4e7f2..8ab1d2da9cfe 100644 --- a/CORE/SERVICES/WMA/wma.c +++ b/CORE/SERVICES/WMA/wma.c @@ -28633,8 +28633,8 @@ VOS_STATUS wma_get_buf_extscan_hotlist_cmd(tp_wma_handle wma_handle, /* setbssid hotlist expects the bssid list * to be non zero value */ - if (!numap) { - WMA_LOGE("%s: Invalid number of bssid's", __func__); + if ((numap <= 0) || (numap > WLAN_EXTSCAN_MAX_HOTLIST_APS)) { + WMA_LOGE("%s: Invalid number of APs: %d", __func__, numap); return VOS_STATUS_E_INVAL; } num_entries = wma_get_hotlist_entries_per_page(wma_handle->wmi_handle, |