From 170d287f1dfbc6b4327f00d77028de2d83d28dd8 Mon Sep 17 00:00:00 2001 From: Dundi Raviteja Date: Fri, 23 Mar 2018 15:49:54 +0530 Subject: [PATCH] qcacld-3.0: Fix buf overflow in __wlan_hdd_cfg80211_update_connect_params Currently, number of bytes being copied into keyname_nai buffer is key_nai_length, which can be greater than FILS_MAX_KEYNAME_NAI_LENGTH. But the size of keyname_nai is limited to FILS_MAX_KEYNAME_NAI_LENGTH, which may cause buffer overflow. To address this issue, add check for key_nai_length against FILS_MAX_KEYNAME_NAI_LENGTH to ensure buffer overflow does not happen. Change-Id: I88c89b1fef6fdb1c4bd93e0fb8f3e54634b4940f CRs-Fixed: 2208881 --- core/hdd/src/wlan_hdd_cfg80211.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/core/hdd/src/wlan_hdd_cfg80211.c b/core/hdd/src/wlan_hdd_cfg80211.c index b82d3c824ccd..3787522389a0 100644 --- a/core/hdd/src/wlan_hdd_cfg80211.c +++ b/core/hdd/src/wlan_hdd_cfg80211.c @@ -22170,6 +22170,12 @@ static int __wlan_hdd_cfg80211_update_connect_params( fils_info->key_nai_length = req->fils_erp_username_len + sizeof(char) + req->fils_erp_realm_len; + if (fils_info->key_nai_length > + FILS_MAX_KEYNAME_NAI_LENGTH) { + hdd_err("Key NAI Length %d", + fils_info->key_nai_length); + return -EINVAL; + } if (req->fils_erp_username_len && req->fils_erp_username) { buf = fils_info->keyname_nai; qdf_mem_copy(buf, req->fils_erp_username,