From 1be92caa6cac65da02aa3db41ae9accbf044aeca Mon Sep 17 00:00:00 2001 From: Nachiket Kukade Date: Tue, 14 Nov 2017 16:49:11 +0530 Subject: [PATCH] qcacld-3.0: Corrections in buffer length checks in set_fils_config In wlan_hdd_cfg80211_set_fils_config, incoming fils configs are copied into local buffers. Buffer allocations happen with internal length definitions, while lengths are checked against definitions from WMI API's. This may cause a buffer overwrite for fils erp realm buffer. Use the same definitions for length checks that are used for allocations. Change-Id: Ie26bb1fdec9b12b429cb74dd290c155deb6c32f8 CRs-Fixed: 2137834 --- core/hdd/src/wlan_hdd_cfg80211.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/core/hdd/src/wlan_hdd_cfg80211.c b/core/hdd/src/wlan_hdd_cfg80211.c index cab3ef7d659e..0736c6ae3e23 100644 --- a/core/hdd/src/wlan_hdd_cfg80211.c +++ b/core/hdd/src/wlan_hdd_cfg80211.c @@ -16208,9 +16208,9 @@ static int wlan_hdd_cfg80211_set_fils_config(struct hdd_adapter *adapter, req->fils_erp_next_seq_num, req->auth_type, req->fils_erp_username_len, req->fils_erp_rrk_len, req->fils_erp_realm_len); - if (req->fils_erp_rrk_len > WMI_FILS_MAX_RRK_LENGTH || - req->fils_erp_realm_len > WMI_FILS_MAX_REALM_LENGTH || - req->fils_erp_username_len > WMI_FILS_MAX_USERNAME_LENGTH) { + if (req->fils_erp_rrk_len > FILS_MAX_RRK_LENGTH || + req->fils_erp_realm_len > FILS_MAX_REALM_LEN || + req->fils_erp_username_len > FILS_MAX_KEYNAME_NAI_LENGTH) { hdd_err("FILS info length limit exceeded"); goto fils_conn_fail; }