diff options
| -rw-r--r-- | core/hdd/src/wlan_hdd_ioctl.c | 11 |
1 files changed, 8 insertions, 3 deletions
diff --git a/core/hdd/src/wlan_hdd_ioctl.c b/core/hdd/src/wlan_hdd_ioctl.c index a08cf59325ce..3cbd92566d33 100644 --- a/core/hdd/src/wlan_hdd_ioctl.c +++ b/core/hdd/src/wlan_hdd_ioctl.c @@ -566,8 +566,9 @@ static QDF_STATUS hdd_parse_get_ibss_peer_info(uint8_t *pValue, struct qdf_mac_addr *pPeerMacAddr) { uint8_t *inPtr = pValue; + size_t in_ptr_len = strlen(pValue); - inPtr = strnchr(pValue, strlen(pValue), SPACE_ASCII_VALUE); + inPtr = strnchr(pValue, in_ptr_len, SPACE_ASCII_VALUE); if (NULL == inPtr) return QDF_STATUS_E_FAILURE; @@ -580,10 +581,14 @@ hdd_parse_get_ibss_peer_info(uint8_t *pValue, struct qdf_mac_addr *pPeerMacAddr) if ('\0' == *inPtr) return QDF_STATUS_E_FAILURE; + in_ptr_len -= (inPtr - pValue); + if (in_ptr_len < 17) + return QDF_STATUS_E_FAILURE; + if (inPtr[2] != ':' || inPtr[5] != ':' || inPtr[8] != ':' || - inPtr[11] != ':' || inPtr[14] != ':') { + inPtr[11] != ':' || inPtr[14] != ':') return QDF_STATUS_E_FAILURE; - } + sscanf(inPtr, "%2x:%2x:%2x:%2x:%2x:%2x", (unsigned int *)&pPeerMacAddr->bytes[0], (unsigned int *)&pPeerMacAddr->bytes[1], |