From ac5312a18861255e4035bda08acb41cc0fa7b3f5 Mon Sep 17 00:00:00 2001 From: Srinivas Dasari Date: Fri, 23 Aug 2019 07:21:46 +0530 Subject: [PATCH] qcacld-3.0: Validate the size of each frequecy sub attribute QCA_ATTR_ROAM_CONTROL_SCAN_FREQ_LIST is a nested attribute which carries frequencies as sub attributes. Validate the size of each sub attribute to make sure it's of size uint32_t. Extract the frequencies if all are of valid size. Return failure if an invalid length attribute is found. Change-Id: I1743c2dbef640b28b78504a548edbb70f4f29e49 CRs-Fixed: 2513822 --- core/hdd/src/wlan_hdd_cfg80211.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/core/hdd/src/wlan_hdd_cfg80211.c b/core/hdd/src/wlan_hdd_cfg80211.c index a89b4a1141b5..4d2fcc470a71 100644 --- a/core/hdd/src/wlan_hdd_cfg80211.c +++ b/core/hdd/src/wlan_hdd_cfg80211.c @@ -4104,8 +4104,14 @@ hdd_send_roam_scan_channel_freq_list_to_sme(struct hdd_context *hdd_ctx, } num_chan = 0; - nla_for_each_nested(curr_attr, tb2[PARAM_SCAN_FREQ_LIST], rem) + nla_for_each_nested(curr_attr, tb2[PARAM_SCAN_FREQ_LIST], rem) { + if (nla_len(curr_attr) != sizeof(uint32_t)) { + hdd_err("len is not correct for frequency %d", + num_chan); + return QDF_STATUS_E_INVAL; + } freq_list[num_chan++] = nla_get_u32(curr_attr); + } status = sme_update_roam_scan_freq_list(mac_handle, vdev_id, freq_list, num_chan, list_type);