From 2e1a11a6b01810bf84d5f291dea5c3f996d30bc2 Mon Sep 17 00:00:00 2001 From: Abhishek Singh Date: Thu, 6 Jul 2017 11:24:11 +0530 Subject: [PATCH] qcacld-3.0: Fix buffer overflow in wmi roam scan filter cmd The length of buffer used to send wmi roam scan filter cmd is not properly calculated and the length is less than the data to be copied. Fix it by properly calculating the length of the buffer. Change-Id: I971ff3c1313d617cc3174150c738ba20f931d2a1 CRs-Fixed: 2072064 --- core/wma/src/wma_scan_roam.c | 14 +------------- 1 file changed, 1 insertion(+), 13 deletions(-) diff --git a/core/wma/src/wma_scan_roam.c b/core/wma/src/wma_scan_roam.c index 242f8a200db2..f9e35bad52dd 100644 --- a/core/wma/src/wma_scan_roam.c +++ b/core/wma/src/wma_scan_roam.c @@ -1577,7 +1577,7 @@ static QDF_STATUS wma_roam_scan_filter(tp_wma_handle wma_handle, { int i; QDF_STATUS status = QDF_STATUS_SUCCESS; - uint32_t len = 0, num_bssid_black_list = 0, num_ssid_white_list = 0, + uint32_t num_bssid_black_list = 0, num_ssid_white_list = 0, num_bssid_preferred_list = 0; uint32_t op_bitmap = 0; struct roam_ext_params *roam_params; @@ -1596,23 +1596,16 @@ static QDF_STATUS wma_roam_scan_filter(tp_wma_handle wma_handle, op_bitmap |= 0x1; num_bssid_black_list = roam_params->num_bssid_avoid_list; - len = num_bssid_black_list * sizeof(wmi_mac_addr); - len += WMI_TLV_HDR_SIZE; break; case REASON_ROAM_SET_SSID_ALLOWED: op_bitmap |= 0x2; num_ssid_white_list = roam_params->num_ssid_allowed_list; - len = num_ssid_white_list * sizeof(wmi_ssid); - len += WMI_TLV_HDR_SIZE; break; case REASON_ROAM_SET_FAVORED_BSSID: op_bitmap |= 0x4; num_bssid_preferred_list = roam_params->num_bssid_favored; - len = num_bssid_preferred_list * sizeof(wmi_mac_addr); - len += WMI_TLV_HDR_SIZE; - len += num_bssid_preferred_list * sizeof(A_UINT32); break; default: WMA_LOGD("%s : Roam Filter need not be sent", __func__); @@ -1626,11 +1619,7 @@ static QDF_STATUS wma_roam_scan_filter(tp_wma_handle wma_handle, */ op_bitmap = 0x2 | 0x4; num_ssid_white_list = roam_params->num_ssid_allowed_list; - len = num_ssid_white_list * sizeof(wmi_ssid); num_bssid_preferred_list = roam_params->num_bssid_favored; - len += num_bssid_preferred_list * sizeof(wmi_mac_addr); - len += num_bssid_preferred_list * sizeof(A_UINT32); - len += (2 * WMI_TLV_HDR_SIZE); } /* fill in fixed values */ @@ -1639,7 +1628,6 @@ static QDF_STATUS wma_roam_scan_filter(tp_wma_handle wma_handle, params->num_bssid_black_list = num_bssid_black_list; params->num_ssid_white_list = num_ssid_white_list; params->num_bssid_preferred_list = num_bssid_preferred_list; - params->len = len; qdf_mem_copy(params->bssid_avoid_list, roam_params->bssid_avoid_list, MAX_BSSID_AVOID_LIST * sizeof(struct qdf_mac_addr));