A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-14 16:46:15 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Add check for set_ft_ies buffer length

Browse source 
Add check for buffer length in function sme_set_ft_ies.

Change-Id: I7adc56e23316c0ceb193a5bdf8c4c0b5f4fbd20a
CRs-Fixed: 2055659
This commit is contained in:
Naveen Rawat 2017-06-13 17:29:51 -07:00 • committed by snandini
commit c921c7b2cc
2 changed files with 7 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

5
core/hdd/src/wlan_hdd_wext.c
View file

@ -14000,6 +14000,11 @@ static const struct iw_priv_args we_private_args[] = {
0,
"enable_range_ext"}
,
{WLAN_PRIV_SET_FTIES,
IW_PRIV_TYPE_CHAR | MAX_FTIE_SIZE,
0,
"set_ft_ies"},
};
const struct iw_handler_def we_handler_def = {

4
core/sme/src/common/sme_ft_api.c
View file

@ -151,6 +151,7 @@ void sme_set_ft_ies(tHalHandle hal_ptr, uint32_t session_id,
switch (session->ftSmeContext.FTState) {
case eFT_START_READY:
case eFT_AUTH_REQ_READY:
sme_debug("ft_ies_length: %d", ft_ies_length);
if ((session->ftSmeContext.auth_ft_ies) &&
(session->ftSmeContext.auth_ft_ies_length)) {
/* Free the one we recvd last from supplicant */
@ -158,6 +159,7 @@ void sme_set_ft_ies(tHalHandle hal_ptr, uint32_t session_id,
session->ftSmeContext.auth_ft_ies_length = 0;
session->ftSmeContext.auth_ft_ies = NULL;
}
ft_ies_length = QDF_MIN(ft_ies_length, MAX_FTIE_SIZE);
/* Save the FT IEs */
session->ftSmeContext.auth_ft_ies =
qdf_mem_malloc(ft_ies_length);
@ -170,8 +172,6 @@ void sme_set_ft_ies(tHalHandle hal_ptr, uint32_t session_id,
qdf_mem_copy((uint8_t *)session->ftSmeContext.auth_ft_ies,
ft_ies, ft_ies_length);
session->ftSmeContext.FTState = eFT_AUTH_REQ_READY;
sme_debug("ft_ies_length: %d", ft_ies_length);
break;
case eFT_AUTH_COMPLETE: