瀏覽代碼

qcacld-3.0: Avoid buffer overread while processing set pno IOCTL

While processing set pno IOCTL, input argument 'extra' is printed
without making sure it's NULL terminated.

Log input string 'extra' after making sure it's NULL terminated.

Change-Id: I4158103a85c0828dad240cf00b34da94e6a8cc62
CRs-Fixed: 2228601
Hanumanth Reddy Pothula 7 年之前
父節點
當前提交
3048c93707
共有 1 個文件被更改,包括 2 次插入2 次删除
  1. 2 2
      core/hdd/src/wlan_hdd_wext.c

+ 2 - 2
core/hdd/src/wlan_hdd_wext.c

@@ -8646,8 +8646,6 @@ static int __iw_set_pno(struct net_device *dev,
 		return -EIO;
 	}
 
-	hdd_debug("PNO data len %d data %s", wrqu->data.length, extra);
-
 	/* making sure argument string ends with '\0' */
 	len = (wrqu->data.length + 1);
 	data = qdf_mem_malloc(len);
@@ -8658,6 +8656,8 @@ static int __iw_set_pno(struct net_device *dev,
 	qdf_mem_copy(data, extra, (len-1));
 	ptr = data;
 
+	hdd_debug("PNO data len %d data %s", wrqu->data.length, data);
+
 	if (1 != sscanf(ptr, " %hhu %n", &value, &offset)) {
 		hdd_err("PNO enable input is not valid %s", ptr);
 		ret = -EINVAL;