From 77564183fc9db2885d352ccc9b54d6a6a06d653c Mon Sep 17 00:00:00 2001 From: Anurag Chouhan Date: Sat, 3 Sep 2016 16:38:01 +0530 Subject: [PATCH] qcacld-3.0: Fix buffer over read in iwpriv WE_UNIT_TEST_CMD command qcacld-2.0 to qcacld-3.0 propagation. In current driver, WE_UNIT_TEST_CMD has below problem. - apps_arg[1] can have zero value and can lead to buffer overead Change the code to handle the number of args if user has given zero. CRs-Fixed: 1029540 Change-Id: Idc8e1d77d9623daeb98d0c4b7ad8a8d6cfa9c2d2 (cherry picked from commit 063a0db662927174d22af3b78402c63d7c388112) --- core/hdd/src/wlan_hdd_wext.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/core/hdd/src/wlan_hdd_wext.c b/core/hdd/src/wlan_hdd_wext.c index bc5a26a8b1bc..824e46c24d5a 100644 --- a/core/hdd/src/wlan_hdd_wext.c +++ b/core/hdd/src/wlan_hdd_wext.c @@ -8002,8 +8002,9 @@ static int __iw_set_var_ints_getnone(struct net_device *dev, apps_args[0]); return -EINVAL; } - if (apps_args[1] > (WMA_MAX_NUM_ARGS)) { - hdd_err("Too Many args %d", + if ((apps_args[1] > (WMA_MAX_NUM_ARGS)) || + (apps_args[1] < 0)) { + hdd_err("Too Many/Few args %d", apps_args[1]); return -EINVAL; }