From 89c58d2137a92f2a6b4f3e085226a60a9dc4b13c Mon Sep 17 00:00:00 2001
From: SaidiReddy Yenuga <saidir@codeaurora.org>
Date: Wed, 21 Sep 2016 13:44:35 +0530
Subject: [PATCH] qcacld-3.0: Add SSID length boundary check while processing
 vendor scan request

While extracting SSID from nl attributes, Currently there is
no boundary check for max and min length. Hence host causes
buffer overflow.

As a part of this fix, Add ssid array boundary check to avoid
buffer overflow.

CRs-Fixed: 1069298
Change-Id: I395be358f7bf3f23bb9453d1ed6c3dc9025f4aab
---
 core/hdd/src/wlan_hdd_scan.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/core/hdd/src/wlan_hdd_scan.c b/core/hdd/src/wlan_hdd_scan.c
index 40b1e6f3b520..f955421b0ce6 100644
--- a/core/hdd/src/wlan_hdd_scan.c
+++ b/core/hdd/src/wlan_hdd_scan.c
@@ -2012,6 +2012,12 @@ static int __wlan_hdd_cfg80211_vendor_scan(struct wiphy *wiphy,
 		nla_for_each_nested(attr, tb[QCA_WLAN_VENDOR_ATTR_SCAN_SSIDS],
 				tmp) {
 			request->ssids[count].ssid_len = nla_len(attr);
+			if (request->ssids[count].ssid_len >
+				SIR_MAC_MAX_SSID_LENGTH) {
+				hdd_err("SSID Len %d is not correct for network %d",
+					 request->ssids[count].ssid_len, count);
+				goto error;
+			}
 			memcpy(request->ssids[count].ssid, nla_data(attr),
 					nla_len(attr));
 			count++;