From fcb4dd8ea0d03dc1970c9b9ef8acc9e0327cd6e4 Mon Sep 17 00:00:00 2001 From: Jeff Johnson Date: Fri, 18 Nov 2016 11:02:24 -0800 Subject: qcacld-3.0: Validate "set passpoint list" network count This is a qcacld-2.0 to qcacld-3.0 propagation. Currently when processing the "set passpoint list" vendor command the "number of networks" parameter is not limit checked. This value is subsequently used to calculate the size of a buffer. Add a limit check to ensure that an appropriately sized buffer is always allocated. Change-Id: Ibc2346b8a62898fc47e2d1efe457c57c08b0cada CRs-Fixed: 1091940 --- core/hdd/src/wlan_hdd_ext_scan.c | 6 ++++++ core/mac/inc/sir_api.h | 1 + 2 files changed, 7 insertions(+) diff --git a/core/hdd/src/wlan_hdd_ext_scan.c b/core/hdd/src/wlan_hdd_ext_scan.c index 1a7cf50339f6..6515bd4c7b6b 100644 --- a/core/hdd/src/wlan_hdd_ext_scan.c +++ b/core/hdd/src/wlan_hdd_ext_scan.c @@ -4196,6 +4196,12 @@ static int __wlan_hdd_cfg80211_set_passpoint_list(struct wiphy *wiphy, } num_networks = nla_get_u32( tb[QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_LIST_PARAM_NUM]); + if (num_networks > SIR_PASSPOINT_LIST_MAX_NETWORKS) { + hdd_err("num networks %u exceeds max %u", + num_networks, SIR_PASSPOINT_LIST_MAX_NETWORKS); + return -EINVAL; + } + hdd_notice("num networks %u", num_networks); req_msg = qdf_mem_malloc(sizeof(*req_msg) + diff --git a/core/mac/inc/sir_api.h b/core/mac/inc/sir_api.h index 1cfcf4c1ac18..4791ea95c4eb 100644 --- a/core/mac/inc/sir_api.h +++ b/core/mac/inc/sir_api.h @@ -4749,6 +4749,7 @@ struct wifi_epno_params { struct wifi_epno_network networks[]; }; +#define SIR_PASSPOINT_LIST_MAX_NETWORKS 8 #define SIR_PASSPOINT_REALM_LEN 256 #define SIR_PASSPOINT_ROAMING_CONSORTIUM_ID_NUM 16 #define SIR_PASSPOINT_PLMN_LEN 3 -- cgit v1.2.3