From d0077986f1e8bc5d4a612409f0ad12f135cf2475 Mon Sep 17 00:00:00 2001 From: Bapiraju Alla Date: Tue, 20 Oct 2020 23:17:57 +0530 Subject: [PATCH] qcacmn: Validate NDP app info length before accessing NDP app info Currently, NDP app info length is not being validated with max NDP app info length. This may result in buffer oveflow wile accessing NDP app info received from the firmware. To address this, validate NDP app info length before accessing NDP app info Change-Id: Ifddf1afca7ecf2585e8eb450864d9ba127238f6e CRs-Fixed: 2795961 --- wmi/src/wmi_unified_nan_tlv.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/wmi/src/wmi_unified_nan_tlv.c b/wmi/src/wmi_unified_nan_tlv.c index a08d34c09b42..baa660df95c0 100644 --- a/wmi/src/wmi_unified_nan_tlv.c +++ b/wmi/src/wmi_unified_nan_tlv.c @@ -926,6 +926,10 @@ static QDF_STATUS extract_ndp_confirm_tlv(wmi_unified_t wmi_handle, WMI_MAC_ADDR_TO_CHAR_ARRAY(&fixed_params->peer_ndi_mac_addr, rsp->peer_ndi_mac_addr.bytes); rsp->ndp_info.ndp_app_info_len = fixed_params->ndp_app_info_len; + + if (rsp->ndp_info.ndp_app_info_len > NDP_APP_INFO_LEN) + rsp->ndp_info.ndp_app_info_len = NDP_APP_INFO_LEN; + qdf_mem_copy(rsp->ndp_info.ndp_app_info, event->ndp_app_info, rsp->ndp_info.ndp_app_info_len);