From 476deeb893c9917c2c2849ec5d57334fa59d2471 Mon Sep 17 00:00:00 2001 From: Srinivas Girigowda Date: Tue, 19 Jul 2016 16:21:29 -0700 Subject: qcacld-3.0: Fix buffer overwrite problem in CCXBEACONREQ This is a propagation from qcacld-2.0 to qcacld-3.0. Set the number of IE fields to minimum of input data and SIR_ESE_MAX_MEAS_IE_REQS Change-Id: Ie53cfec7872ab69530bbb8932f9f9e85fb319f92 CRs-Fixed: 993561 --- core/hdd/src/wlan_hdd_ioctl.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/core/hdd/src/wlan_hdd_ioctl.c b/core/hdd/src/wlan_hdd_ioctl.c index 61c1a77aec74..a45115aa7185 100644 --- a/core/hdd/src/wlan_hdd_ioctl.c +++ b/core/hdd/src/wlan_hdd_ioctl.c @@ -2642,7 +2642,7 @@ static int hdd_parse_ese_beacon_req(uint8_t *pValue, if ('\0' == *inPtr) return -EINVAL; - /* get the first argument ie measurement token */ + /* Getting the first argument ie Number of IE fields */ v = sscanf(inPtr, "%31s ", buf); if (1 != v) return -EINVAL; @@ -2651,10 +2651,10 @@ static int hdd_parse_ese_beacon_req(uint8_t *pValue, if (v < 0) return -EINVAL; + tempInt = QDF_MIN(tempInt, SIR_ESE_MAX_MEAS_IE_REQS); pEseBcnReq->numBcnReqIe = tempInt; - hdd_info("Number of Bcn Req Ie fields(%d)", - pEseBcnReq->numBcnReqIe); + hdd_info("Number of Bcn Req Ie fields: %d", pEseBcnReq->numBcnReqIe); for (j = 0; j < (pEseBcnReq->numBcnReqIe); j++) { for (i = 0; i < 4; i++) { -- cgit v1.2.3