A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-10 06:09:23 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: validate essid length before processing scan req

Browse source 
qcacld-2.0 to qcacld-3.0 propagation

Presently we are not validating the length of the essid received
and directly copying the buffer without size checking.

Perform bound checking before processing the scan req.

Change-Id: I786e4feb67bf039df3d217138a412da54f51787d
CRs-fixed: 890228
This commit is contained in:
Rajeev Kumar Sirasanagandla 2016-09-06 21:16:48 +05:30 • committed by Gerrit - the friendly Code Review server
commit 9cb32c0867
1 changed files with 5 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
core/hdd/src/wlan_hdd_scan.c
View file

@ -783,7 +783,8 @@ static int __iw_set_scan(struct net_device *dev, struct iw_request_info *info,
if (wrqu->data.flags & IW_SCAN_THIS_ESSID) {
if (scanReq->essid_len) {
if (scanReq->essid_len &&
(scanReq->essid_len <= SIR_MAC_MAX_SSID_LENGTH)) {
scanRequest.SSIDs.numOfSSIDs = 1;
scanRequest.SSIDs.SSIDList =
(tCsrSSIDInfo *)
@ -800,6 +801,9 @@ static int __iw_set_scan(struct net_device *dev, struct iw_request_info *info,
hdd_err("Unable to allocate memory");
QDF_ASSERT(0);
}
} else {
hdd_err("Invalid essid length : %d",
scanReq->essid_len);
}
}