From 0fd49e9a6fabac65d67255a220cbb3b3e2888033 Mon Sep 17 00:00:00 2001 From: Lihua Liu Date: Mon, 2 Jul 2018 18:55:56 +0800 Subject: [PATCH] qcacmn: Add check for valid length to avoid buffer overflow Add check for valid length before copying in function extract_ndp_ind_tlv to avoid potential buffer overflow issue. CRs-Fixed: 2271344 Change-Id: I2ddcbc46a45d4d5308b1e0cf663598c85512bbaf --- wmi/src/wmi_unified_tlv.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/wmi/src/wmi_unified_tlv.c b/wmi/src/wmi_unified_tlv.c index ef69e6c7a496..4327481a6325 100644 --- a/wmi/src/wmi_unified_tlv.c +++ b/wmi/src/wmi_unified_tlv.c @@ -16784,10 +16784,19 @@ static QDF_STATUS extract_ndp_ind_tlv(wmi_unified_t wmi_handle, rsp->ndp_info.ndp_app_info_len = fixed_params->ndp_app_info_len; rsp->ncs_sk_type = fixed_params->nan_csid; rsp->scid.scid_len = fixed_params->nan_scid_len; + + if (rsp->ndp_config.ndp_cfg_len > NDP_QOS_INFO_LEN) + rsp->ndp_config.ndp_cfg_len = NDP_QOS_INFO_LEN; qdf_mem_copy(rsp->ndp_config.ndp_cfg, event->ndp_cfg, rsp->ndp_config.ndp_cfg_len); + + if (rsp->ndp_info.ndp_app_info_len > NDP_APP_INFO_LEN) + rsp->ndp_info.ndp_app_info_len = NDP_APP_INFO_LEN; qdf_mem_copy(rsp->ndp_info.ndp_app_info, event->ndp_app_info, rsp->ndp_info.ndp_app_info_len); + + if (rsp->scid.scid_len > NDP_SCID_BUF_LEN) + rsp->scid.scid_len = NDP_SCID_BUF_LEN; qdf_mem_copy(rsp->scid.scid, event->ndp_scid, rsp->scid.scid_len); if (event->ndp_transport_ip_param &&