From c356f15969fb99b7f587dee7ef246586923294da Mon Sep 17 00:00:00 2001 From: SaidiReddy Yenuga Date: Thu, 6 Apr 2017 17:43:01 +0530 Subject: [PATCH] qcacld-3.0: Fix buffer over flow in hdd state ctrl In hdd state ctrl API buf used beyond its size. Increase buf size to 3 to get rid of buffer over flow. CRs-fixed: 2029584 Change-Id: Ie353d449f167bee05833841350d61dc0935786fc --- core/hdd/src/wlan_hdd_main.c | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/core/hdd/src/wlan_hdd_main.c b/core/hdd/src/wlan_hdd_main.c index 6d4e2172cbf6..601e0c6cb011 100644 --- a/core/hdd/src/wlan_hdd_main.c +++ b/core/hdd/src/wlan_hdd_main.c @@ -10547,23 +10547,23 @@ static ssize_t wlan_hdd_state_ctrl_param_write(struct file *filp, size_t count, loff_t *f_pos) { - char buf; + char buf[3]; static const char wlan_off_str[] = "OFF"; static const char wlan_on_str[] = "ON"; int ret; unsigned long rc; - if (copy_from_user(&buf, user_buf, 3)) { + if (copy_from_user(buf, user_buf, 3)) { pr_err("Failed to read buffer\n"); return -EINVAL; } - if (strncmp(&buf, wlan_off_str, strlen(wlan_off_str)) == 0) { + if (strncmp(buf, wlan_off_str, strlen(wlan_off_str)) == 0) { pr_debug("Wifi turning off from UI\n"); goto exit; } - if (strncmp(&buf, wlan_on_str, strlen(wlan_on_str)) != 0) { + if (strncmp(buf, wlan_on_str, strlen(wlan_on_str)) != 0) { pr_err("Invalid value received from framework"); goto exit; }