From 3061e77628af4910edfcd33465bc21a2f034d545 Mon Sep 17 00:00:00 2001 From: Srinivas Girigowda Date: Tue, 7 Jul 2015 13:27:35 -0700 Subject: qcacld-2.0: Fix buffer overwrite problem in GETFASTTRANSITION If (len + 1) is greater than priv_data.total_len then copy_to_user results in writing more data than the buffer can hold. Fix this by writing mininum of (len + 1) and priv_data.total_len. Change-Id: Ib5c5c61704c810652206004c302c69a2243f9b5a CRs-Fixed: 865565 --- CORE/HDD/src/wlan_hdd_main.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/CORE/HDD/src/wlan_hdd_main.c b/CORE/HDD/src/wlan_hdd_main.c index c071ec60127a..abd12efd3a5c 100755 --- a/CORE/HDD/src/wlan_hdd_main.c +++ b/CORE/HDD/src/wlan_hdd_main.c @@ -4563,8 +4563,8 @@ static int hdd_driver_command(hdd_adapter_t *pAdapter, len = scnprintf(extra, sizeof(extra), "%s %d", "GETFASTTRANSITION", ft); - if (copy_to_user(priv_data.buf, &extra, len + 1)) - { + len = VOS_MIN(priv_data.total_len, len + 1); + if (copy_to_user(priv_data.buf, &extra, len)) { VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR, "%s: failed to copy data to user buffer", __func__); ret = -EFAULT; -- cgit v1.2.3