From f5b6da2359f286ba570d0604ecaad68df3202e5c Mon Sep 17 00:00:00 2001 From: Rajeev Kumar Date: Fri, 15 Apr 2016 13:24:03 -0700 Subject: [PATCH] qcacld 3.0: Address buffer overflow due to invalid length qcacld-2.0 to qcacld-3.0 propagation Check for valid length before copying the packet filter data from userspace buffer to kernel space buffer to avoid buffer overflow issue. Change-Id: I9548727543b903b5eaafa25c6184615d511ca99d CRs-Fixed: 930533 --- core/hdd/src/wlan_hdd_wext.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/core/hdd/src/wlan_hdd_wext.c b/core/hdd/src/wlan_hdd_wext.c index af8c3c5af3d0..4b4dc776944c 100644 --- a/core/hdd/src/wlan_hdd_wext.c +++ b/core/hdd/src/wlan_hdd_wext.c @@ -8921,6 +8921,13 @@ static int wlan_hdd_set_filter(hdd_context_t *hdd_ctx, request->params_data[i].data_offset, request->params_data[i].data_length); + if (sizeof(packetFilterSetReq.paramsData[i].compareData) + < (request->params_data[i].data_length)) { + hdd_err("Error invalid data length %d", + request->params_data[i].data_length); + return -EINVAL; + } + memcpy(&packetFilterSetReq.paramsData[i].compareData, request->params_data[i].compare_data, request->params_data[i].data_length);