A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-12 07:37:31 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Prevent buffer overflow in QCSAP_IOCTL_VERSION

Browse source 
qcacld-2.0 to qcacld-3.0 propagation

The QCSAP_IOCTL_VERSION IOCTL is registered with a maximum GET
buffer length of QCSAP_MAX_SC_IE = 256 bytes. But while filling
buffer, Host allows to fill till WE_MAX_STR_LEN which may lead to
buffer overflow.
As a part of this fix, Host ensure to register with maximum
WE_MAX_STR_LEN buffer length.

Change-Id: I5ba0268e978c7ddadabc96a4eba18140ff7db3c6
CRs-Fixed: 1001142
(cherry picked from commit 85f4f75e8396e27467716555d68b3a18dd57b6fe)
This commit is contained in:
Mukul Sharma 2016-09-03 13:31:44 +05:30 • committed by qcabuildsw
commit dd93cbca9e
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
core/hdd/src/wlan_hdd_hostapd.c
View file

@ -6035,7 +6035,7 @@ static const struct iw_priv_args hostapd_private_args[] = {
QCSAP_IOCTL_STOPBSS, IW_PRIV_TYPE_BYTE | IW_PRIV_SIZE_FIXED, 0,
"stopbss"
}, {
QCSAP_IOCTL_VERSION, 0, IW_PRIV_TYPE_CHAR | QCSAP_MAX_WSC_IE,
QCSAP_IOCTL_VERSION, 0, IW_PRIV_TYPE_CHAR | WE_MAX_STR_LEN,
"version"
}, {
QCSAP_IOCTL_GET_STA_INFO, 0,