From c921c7b2cc30e064985ca03a8b7704daefe4d592 Mon Sep 17 00:00:00 2001
From: Naveen Rawat <naveenrawat@codeaurora.org>
Date: Tue, 13 Jun 2017 17:29:51 -0700
Subject: [PATCH] qcacld-3.0: Add check for set_ft_ies buffer length

Add check for buffer length in function sme_set_ft_ies.

Change-Id: I7adc56e23316c0ceb193a5bdf8c4c0b5f4fbd20a
CRs-Fixed: 2055659
---
 core/hdd/src/wlan_hdd_wext.c     | 5 +++++
 core/sme/src/common/sme_ft_api.c | 4 ++--
 2 files changed, 7 insertions(+), 2 deletions(-)

diff --git a/core/hdd/src/wlan_hdd_wext.c b/core/hdd/src/wlan_hdd_wext.c
index 0da8635733c9..dd06cf356479 100644
--- a/core/hdd/src/wlan_hdd_wext.c
+++ b/core/hdd/src/wlan_hdd_wext.c
@@ -14000,6 +14000,11 @@ static const struct iw_priv_args we_private_args[] = {
 	 0,
 	 "enable_range_ext"}
 	,
+
+	{WLAN_PRIV_SET_FTIES,
+	 IW_PRIV_TYPE_CHAR | MAX_FTIE_SIZE,
+	 0,
+	 "set_ft_ies"},
 };
 
 const struct iw_handler_def we_handler_def = {
diff --git a/core/sme/src/common/sme_ft_api.c b/core/sme/src/common/sme_ft_api.c
index 6bcff127db44..e6b0460af890 100644
--- a/core/sme/src/common/sme_ft_api.c
+++ b/core/sme/src/common/sme_ft_api.c
@@ -151,6 +151,7 @@ void sme_set_ft_ies(tHalHandle hal_ptr, uint32_t session_id,
 	switch (session->ftSmeContext.FTState) {
 	case eFT_START_READY:
 	case eFT_AUTH_REQ_READY:
+		sme_debug("ft_ies_length: %d", ft_ies_length);
 		if ((session->ftSmeContext.auth_ft_ies) &&
 			(session->ftSmeContext.auth_ft_ies_length)) {
 			/* Free the one we recvd last from supplicant */
@@ -158,6 +159,7 @@ void sme_set_ft_ies(tHalHandle hal_ptr, uint32_t session_id,
 			session->ftSmeContext.auth_ft_ies_length = 0;
 			session->ftSmeContext.auth_ft_ies = NULL;
 		}
+		ft_ies_length = QDF_MIN(ft_ies_length, MAX_FTIE_SIZE);
 		/* Save the FT IEs */
 		session->ftSmeContext.auth_ft_ies =
 					qdf_mem_malloc(ft_ies_length);
@@ -170,8 +172,6 @@ void sme_set_ft_ies(tHalHandle hal_ptr, uint32_t session_id,
 		qdf_mem_copy((uint8_t *)session->ftSmeContext.auth_ft_ies,
 				ft_ies, ft_ies_length);
 		session->ftSmeContext.FTState = eFT_AUTH_REQ_READY;
-
-		sme_debug("ft_ies_length: %d", ft_ies_length);
 		break;
 
 	case eFT_AUTH_COMPLETE: