diff options
| -rw-r--r-- | core/hdd/src/wlan_hdd_ext_scan.c | 13 |
1 files changed, 12 insertions, 1 deletions
diff --git a/core/hdd/src/wlan_hdd_ext_scan.c b/core/hdd/src/wlan_hdd_ext_scan.c index 570567005e15..1a7cf50339f6 100644 --- a/core/hdd/src/wlan_hdd_ext_scan.c +++ b/core/hdd/src/wlan_hdd_ext_scan.c @@ -2740,6 +2740,7 @@ static int hdd_extscan_start_fill_bucket_channel_spec( int rem1, rem2; QDF_STATUS status; uint8_t bkt_index, j, num_channels, total_channels = 0; + uint32_t expected_buckets; uint32_t chan_list[WNI_CFG_VALID_CHANNEL_LIST_LEN] = {0}; uint32_t min_dwell_time_active_bucket = @@ -2751,7 +2752,6 @@ static int hdd_extscan_start_fill_bucket_channel_spec( uint32_t max_dwell_time_passive_bucket = hdd_ctx->config->extscan_passive_max_chn_time; - bkt_index = 0; req_msg->min_dwell_time_active = req_msg->max_dwell_time_active = hdd_ctx->config->extscan_active_max_chn_time; @@ -2759,10 +2759,19 @@ static int hdd_extscan_start_fill_bucket_channel_spec( req_msg->min_dwell_time_passive = req_msg->max_dwell_time_passive = hdd_ctx->config->extscan_passive_max_chn_time; + + expected_buckets = req_msg->numBuckets; req_msg->numBuckets = 0; + bkt_index = 0; nla_for_each_nested(buckets, tb[QCA_WLAN_VENDOR_ATTR_EXTSCAN_BUCKET_SPEC], rem1) { + + if (bkt_index >= expected_buckets) { + hdd_warn("ignoring excess buckets"); + break; + } + if (nla_parse(bucket, QCA_WLAN_VENDOR_ATTR_EXTSCAN_SUBCMD_CONFIG_PARAM_MAX, nla_data(buckets), nla_len(buckets), NULL)) { @@ -3256,8 +3265,10 @@ __wlan_hdd_cfg80211_extscan_start(struct wiphy *wiphy, if (num_buckets > WLAN_EXTSCAN_MAX_BUCKETS) { hdd_warn("Exceeded MAX number of buckets: %d", WLAN_EXTSCAN_MAX_BUCKETS); + num_buckets = WLAN_EXTSCAN_MAX_BUCKETS; } hdd_info("Input: Number of Buckets %d", num_buckets); + pReqMsg->numBuckets = num_buckets; /* This is optional attribute, if not present set it to 0 */ if (!tb[PARAM_CONFIG_FLAGS]) |