From 1c7c51da83b69d0d8a2d2fbb27d0827d270d7103 Mon Sep 17 00:00:00 2001 From: Jeff Johnson Date: Wed, 2 Nov 2016 11:34:12 -0700 Subject: [PATCH] qcacld-3.0: Properly validate the band in vendor scan command Currently in __wlan_hdd_cfg80211_vendor_scan() the band parsed from the QCA_WLAN_VENDOR_ATTR_SCAN_SUPP_RATES is not sufficiently validated before being used. Validate the actual value before attempting to use it as an index. Change-Id: I0db43ab8e73e20c8cb60a75a521a934967615023 CRs-Fixed: 1085099 --- core/hdd/src/wlan_hdd_scan.c | 15 +++++++++------ 1 file changed, 9 insertions(+), 6 deletions(-) diff --git a/core/hdd/src/wlan_hdd_scan.c b/core/hdd/src/wlan_hdd_scan.c index f955421b0ce6..f74c58fb99b0 100644 --- a/core/hdd/src/wlan_hdd_scan.c +++ b/core/hdd/src/wlan_hdd_scan.c @@ -2038,14 +2038,17 @@ static int __wlan_hdd_cfg80211_vendor_scan(struct wiphy *wiphy, if (tb[QCA_WLAN_VENDOR_ATTR_SCAN_SUPP_RATES]) { nla_for_each_nested(attr, - tb[QCA_WLAN_VENDOR_ATTR_SCAN_SUPP_RATES], - tmp) { + tb[QCA_WLAN_VENDOR_ATTR_SCAN_SUPP_RATES], + tmp) { band = nla_type(attr); + if (band >= NUM_NL80211_BANDS) + continue; if (!wiphy->bands[band]) continue; - request->rates[band] = wlan_hdd_get_rates(wiphy, - band, nla_data(attr), - nla_len(attr)); + request->rates[band] = + wlan_hdd_get_rates(wiphy, + band, nla_data(attr), + nla_len(attr)); } } @@ -2053,7 +2056,7 @@ static int __wlan_hdd_cfg80211_vendor_scan(struct wiphy *wiphy, request->flags = nla_get_u32(tb[QCA_WLAN_VENDOR_ATTR_SCAN_FLAGS]); if ((request->flags & NL80211_SCAN_FLAG_LOW_PRIORITY) && - !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) { + !(wiphy->features & NL80211_FEATURE_LOW_PRIORITY_SCAN)) { hdd_err("LOW PRIORITY SCAN not supported"); goto error; }