From 410317af7ebb7ee1dd1bc401cbb7c1665c266988 Mon Sep 17 00:00:00 2001 From: Kiran Kumar Lokere Date: Mon, 4 Jun 2018 16:54:53 -0700 Subject: [PATCH] qcacld-3.0: Fix out of bound access to a buffer Copy the country code value to local variable and use it to set the country code to avoid the out of bound access to caller buffer. Change-Id: I48662d4034f5dab496b23af4c1840581061bd2e5 CRs-Fixed: 2247610 --- core/hdd/src/wlan_hdd_regulatory.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/core/hdd/src/wlan_hdd_regulatory.c b/core/hdd/src/wlan_hdd_regulatory.c index 57dc46e985f8..01ead9e27fa2 100644 --- a/core/hdd/src/wlan_hdd_regulatory.c +++ b/core/hdd/src/wlan_hdd_regulatory.c @@ -900,6 +900,7 @@ void hdd_reg_notifier(struct wiphy *wiphy, { QDF_STATUS status = QDF_STATUS_SUCCESS; struct hdd_context *hdd_ctx = wiphy_priv(wiphy); + char country[REG_ALPHA2_LEN + 1] = {0}; hdd_debug("country: %c%c, initiator %d, dfs_region: %d", request->alpha2[0], @@ -909,8 +910,9 @@ void hdd_reg_notifier(struct wiphy *wiphy, switch (request->initiator) { case NL80211_REGDOM_SET_BY_USER: - status = ucfg_reg_set_country(hdd_ctx->hdd_pdev, - request->alpha2); + qdf_mem_copy(country, request->alpha2, QDF_MIN( + sizeof(request->alpha2), sizeof(country))); + status = ucfg_reg_set_country(hdd_ctx->hdd_pdev, country); break; case NL80211_REGDOM_SET_BY_CORE: case NL80211_REGDOM_SET_BY_COUNTRY_IE: