From 9cd0d7c74f1cb9116557ea25fee84f52981a792e Mon Sep 17 00:00:00 2001 From: Ashish Kumar Dhanotiya Date: Wed, 2 Aug 2017 17:08:05 +0530 Subject: [PATCH] qcacld-3.0: Buffer overflow in setrmcenable, setrmcactionperiod There is a buffer overflow while using sscanf in setrmcenable and setrmcactionperiod APIs. To resolve this, use sscanf according to buffer length. Change-Id: I91b0c36cb8c67d45afb0b95ac944f9e87187f85a CRs-Fixed: 2086337 --- core/hdd/src/wlan_hdd_ioctl.c | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/core/hdd/src/wlan_hdd_ioctl.c b/core/hdd/src/wlan_hdd_ioctl.c index 9533006d3640..49c586cfdbea 100644 --- a/core/hdd/src/wlan_hdd_ioctl.c +++ b/core/hdd/src/wlan_hdd_ioctl.c @@ -234,7 +234,7 @@ static int hdd_parse_setrmcenable_command(uint8_t *pValue, if ('\0' == *inPtr) return 0; - v = sscanf(inPtr, "%32s ", buf); + v = sscanf(inPtr, "%31s ", buf); if (1 != v) return -EINVAL; @@ -272,7 +272,7 @@ static int hdd_parse_setrmcactionperiod_command(uint8_t *pValue, if ('\0' == *inPtr) return 0; - v = sscanf(inPtr, "%32s ", buf); + v = sscanf(inPtr, "%31s ", buf); if (1 != v) return -EINVAL;