From dd93cbca9eac0aa27ba043036f46f8a3c016c58b Mon Sep 17 00:00:00 2001 From: Mukul Sharma Date: Sat, 3 Sep 2016 13:31:44 +0530 Subject: [PATCH] qcacld-3.0: Prevent buffer overflow in QCSAP_IOCTL_VERSION qcacld-2.0 to qcacld-3.0 propagation The QCSAP_IOCTL_VERSION IOCTL is registered with a maximum GET buffer length of QCSAP_MAX_SC_IE = 256 bytes. But while filling buffer, Host allows to fill till WE_MAX_STR_LEN which may lead to buffer overflow. As a part of this fix, Host ensure to register with maximum WE_MAX_STR_LEN buffer length. Change-Id: I5ba0268e978c7ddadabc96a4eba18140ff7db3c6 CRs-Fixed: 1001142 (cherry picked from commit 85f4f75e8396e27467716555d68b3a18dd57b6fe) --- core/hdd/src/wlan_hdd_hostapd.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/hdd/src/wlan_hdd_hostapd.c b/core/hdd/src/wlan_hdd_hostapd.c index 5ec57b16fe29..d0d20dcf28cf 100644 --- a/core/hdd/src/wlan_hdd_hostapd.c +++ b/core/hdd/src/wlan_hdd_hostapd.c @@ -6035,7 +6035,7 @@ static const struct iw_priv_args hostapd_private_args[] = { QCSAP_IOCTL_STOPBSS, IW_PRIV_TYPE_BYTE | IW_PRIV_SIZE_FIXED, 0, "stopbss" }, { - QCSAP_IOCTL_VERSION, 0, IW_PRIV_TYPE_CHAR | QCSAP_MAX_WSC_IE, + QCSAP_IOCTL_VERSION, 0, IW_PRIV_TYPE_CHAR | WE_MAX_STR_LEN, "version" }, { QCSAP_IOCTL_GET_STA_INFO, 0,