Bladeren bron

qcacld-3.0: Avoid buffer overread while processing set pno IOCTL

While processing set pno IOCTL, input argument 'extra' is printed
without making sure it's NULL terminated.

Log input string 'extra' after making sure it's NULL terminated.

Change-Id: I4158103a85c0828dad240cf00b34da94e6a8cc62
CRs-Fixed: 2228601
Hanumanth Reddy Pothula 7 jaren geleden
bovenliggende
commit
3048c93707
1 gewijzigde bestanden met toevoegingen van 2 en 2 verwijderingen
  1. 2 2
      core/hdd/src/wlan_hdd_wext.c

+ 2 - 2
core/hdd/src/wlan_hdd_wext.c

@@ -8646,8 +8646,6 @@ static int __iw_set_pno(struct net_device *dev,
 		return -EIO;
 	}
 
-	hdd_debug("PNO data len %d data %s", wrqu->data.length, extra);
-
 	/* making sure argument string ends with '\0' */
 	len = (wrqu->data.length + 1);
 	data = qdf_mem_malloc(len);
@@ -8658,6 +8656,8 @@ static int __iw_set_pno(struct net_device *dev,
 	qdf_mem_copy(data, extra, (len-1));
 	ptr = data;
 
+	hdd_debug("PNO data len %d data %s", wrqu->data.length, data);
+
 	if (1 != sscanf(ptr, " %hhu %n", &value, &offset)) {
 		hdd_err("PNO enable input is not valid %s", ptr);
 		ret = -EINVAL;