From 1942caece7c5a70d4e0cc1358d879b07a6a07146 Mon Sep 17 00:00:00 2001 From: Houston Hoffman Date: Thu, 24 Aug 2017 16:59:35 -0700 Subject: [PATCH] qcacld-3.0: Fix PRE_CAC_SSID check bounds check If the ssid_len was greater than the PRE_CAC_SSID string, memcmp would do an out of bounds memory read. Fix by adding a length check. Change-Id: I0d72cfdb2faea74db06640df7418f2a7aecd9afb CRs-Fixed: 2098988 --- core/hdd/src/wlan_hdd_hostapd.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/core/hdd/src/wlan_hdd_hostapd.c b/core/hdd/src/wlan_hdd_hostapd.c index d345e644f648..2fb307c996e2 100644 --- a/core/hdd/src/wlan_hdd_hostapd.c +++ b/core/hdd/src/wlan_hdd_hostapd.c @@ -8196,7 +8196,8 @@ int wlan_hdd_cfg80211_start_bss(struct hdd_adapter *pHostapdAdapter, } } if (!hdd_ctx->config->force_sap_acs && - !(ssid && (0 == qdf_mem_cmp(ssid, PRE_CAC_SSID, ssid_len)))) { + !(ssid && qdf_str_len(PRE_CAC_SSID) == ssid_len && + (0 == qdf_mem_cmp(ssid, PRE_CAC_SSID, ssid_len)))) { pIe = wlan_get_ie_ptr_from_eid(WLAN_EID_SUPP_RATES, &pMgmt_frame->u.beacon.variable[0], pBeacon->head_len);