From c0f7744dc394097572f4fca3e72d814b44de337a Mon Sep 17 00:00:00 2001 From: Sandeep Puligilla Date: Tue, 7 Nov 2017 01:20:32 -0800 Subject: [PATCH] qcacld-3.0: Add a SSID length check Add a SSID length validation check before copying the SSID field to scan request structure from connect profile. Change-Id: Ic6297a28f8852db2e5d22c5c7d5b8eab7b76dbfd CRs-Fixed: 2145706 --- core/sme/src/csr/csr_api_scan.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/core/sme/src/csr/csr_api_scan.c b/core/sme/src/csr/csr_api_scan.c index 801a9a151779..fc2e24d5f2b2 100644 --- a/core/sme/src/csr/csr_api_scan.c +++ b/core/sme/src/csr/csr_api_scan.c @@ -4167,6 +4167,12 @@ QDF_STATUS csr_scan_for_ssid(tpAniSirGlobal mac_ctx, uint32_t session_id, /* Extend it for multiple SSID */ if (profile->SSIDs.numOfSSIDs) { + if (profile->SSIDs.SSIDList[0].SSID.length > MAX_SSID_LEN) { + sme_debug("wrong ssid length = %d", + profile->SSIDs.SSIDList[0].SSID.length); + status = QDF_STATUS_E_INVAL; + goto error; + } req->scan_req.num_ssids = 1; qdf_mem_copy(&req->scan_req.ssid[0].ssid, &profile->SSIDs.SSIDList[0].SSID.ssId,