From 8472cb885f66e14c096393bd059fc8842ea3e753 Mon Sep 17 00:00:00 2001 From: "Padma, Santhosh Kumar" Date: Tue, 7 Nov 2017 18:40:17 +0530 Subject: [PATCH] qcacld-3.0: Avoid buffer overflow Add max check for probe request length against max length of probe request buffer to avoid buffer overflow. Change-Id: Ie0fad7443b2c749c66bb9ad662625a16d3a840c3 CRs-Fixed: 2138555 --- core/mac/src/pe/lim/lim_process_probe_req_frame.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/core/mac/src/pe/lim/lim_process_probe_req_frame.c b/core/mac/src/pe/lim/lim_process_probe_req_frame.c index 7a1362fa66dd..a53c026a8a4e 100644 --- a/core/mac/src/pe/lim/lim_process_probe_req_frame.c +++ b/core/mac/src/pe/lim/lim_process_probe_req_frame.c @@ -665,6 +665,13 @@ lim_send_sme_probe_req_ind(tpAniSirGlobal pMac, MTRACE(mac_trace(pMac, TRACE_CODE_TX_SME_MSG, psessionEntry->peSessionId, msgQ.type)); + + if (ProbeReqIELen > sizeof(pSirSmeProbeReqInd->WPSPBCProbeReq. + probeReqIE)) { + ProbeReqIELen = sizeof(pSirSmeProbeReqInd->WPSPBCProbeReq. + probeReqIE); + } + pSirSmeProbeReqInd->WPSPBCProbeReq.probeReqIELen = (uint16_t) ProbeReqIELen; qdf_mem_copy(pSirSmeProbeReqInd->WPSPBCProbeReq.probeReqIE, pProbeReqIE,