diff options
| -rw-r--r-- | core/hdd/src/wlan_hdd_ext_scan.c | 6 | ||||
| -rw-r--r-- | core/mac/inc/sir_api.h | 1 |
2 files changed, 7 insertions, 0 deletions
diff --git a/core/hdd/src/wlan_hdd_ext_scan.c b/core/hdd/src/wlan_hdd_ext_scan.c index 1a7cf50339f6..6515bd4c7b6b 100644 --- a/core/hdd/src/wlan_hdd_ext_scan.c +++ b/core/hdd/src/wlan_hdd_ext_scan.c @@ -4196,6 +4196,12 @@ static int __wlan_hdd_cfg80211_set_passpoint_list(struct wiphy *wiphy, } num_networks = nla_get_u32( tb[QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_LIST_PARAM_NUM]); + if (num_networks > SIR_PASSPOINT_LIST_MAX_NETWORKS) { + hdd_err("num networks %u exceeds max %u", + num_networks, SIR_PASSPOINT_LIST_MAX_NETWORKS); + return -EINVAL; + } + hdd_notice("num networks %u", num_networks); req_msg = qdf_mem_malloc(sizeof(*req_msg) + diff --git a/core/mac/inc/sir_api.h b/core/mac/inc/sir_api.h index 1cfcf4c1ac18..4791ea95c4eb 100644 --- a/core/mac/inc/sir_api.h +++ b/core/mac/inc/sir_api.h @@ -4749,6 +4749,7 @@ struct wifi_epno_params { struct wifi_epno_network networks[]; }; +#define SIR_PASSPOINT_LIST_MAX_NETWORKS 8 #define SIR_PASSPOINT_REALM_LEN 256 #define SIR_PASSPOINT_ROAMING_CONSORTIUM_ID_NUM 16 #define SIR_PASSPOINT_PLMN_LEN 3 |