Explorar o código

qcacld-3.0: Fix buffer overwrite in csr_roam_diag_joined_new_bss()

Fix possible buffer overwrite in csr_roam_diag_joined_new_bss function.

Change-Id: Icf4a39e0a2a291f1c084353985aa7952e3c8e136
CRs-Fixed: 2233033
Arif Hussain %!s(int64=7) %!d(string=hai) anos
pai
achega
186d7a008c
Modificáronse 1 ficheiros con 4 adicións e 3 borrados
  1. 4 3
      core/sme/src/csr/csr_api_roam.c

+ 4 - 3
core/sme/src/csr/csr_api_roam.c

@@ -12016,9 +12016,10 @@ csr_roam_diag_joined_new_bss(tpAniSirGlobal mac_ctx,
 	pIbssLog->eventId = WLAN_IBSS_EVENT_COALESCING;
 	if (pNewBss) {
 		qdf_copy_macaddr(&pIbssLog->bssid, &pNewBss->bssId);
-		if (pNewBss->ssId.length)
-			qdf_mem_copy(pIbssLog->ssid, pNewBss->ssId.ssId,
-				     pNewBss->ssId.length);
+		if (pNewBss->ssId.length > HOST_LOG_MAX_SSID_SIZE)
+			pNewBss->ssId.length = HOST_LOG_MAX_SSID_SIZE;
+		qdf_mem_copy(pIbssLog->ssid, pNewBss->ssId.ssId,
+			     pNewBss->ssId.length);
 		pIbssLog->operatingChannel = pNewBss->channelNumber;
 	}
 	if (IS_SIR_STATUS_SUCCESS(wlan_cfg_get_int(mac_ctx,