Browse Source

qcacld-3.0: Avoid buffer overread while processing set pno IOCTL

While processing set pno IOCTL, input argument 'extra' is printed
without making sure it's NULL terminated.

Log input string 'extra' after making sure it's NULL terminated.

Change-Id: I4158103a85c0828dad240cf00b34da94e6a8cc62
CRs-Fixed: 2228601
Hanumanth Reddy Pothula 7 years ago
parent
commit
3048c93707
1 changed files with 2 additions and 2 deletions
  1. 2 2
      core/hdd/src/wlan_hdd_wext.c

+ 2 - 2
core/hdd/src/wlan_hdd_wext.c

@@ -8646,8 +8646,6 @@ static int __iw_set_pno(struct net_device *dev,
 		return -EIO;
 	}
 
-	hdd_debug("PNO data len %d data %s", wrqu->data.length, extra);
-
 	/* making sure argument string ends with '\0' */
 	len = (wrqu->data.length + 1);
 	data = qdf_mem_malloc(len);
@@ -8658,6 +8656,8 @@ static int __iw_set_pno(struct net_device *dev,
 	qdf_mem_copy(data, extra, (len-1));
 	ptr = data;
 
+	hdd_debug("PNO data len %d data %s", wrqu->data.length, data);
+
 	if (1 != sscanf(ptr, " %hhu %n", &value, &offset)) {
 		hdd_err("PNO enable input is not valid %s", ptr);
 		ret = -EINVAL;