Procházet zdrojové kódy

qcacld-3.0: Fix out of bound access to a buffer

Copy the country code value to local variable and use
it to set the country code to avoid the out of bound
access to caller buffer.

Change-Id: I48662d4034f5dab496b23af4c1840581061bd2e5
CRs-Fixed: 2247610
Kiran Kumar Lokere před 6 roky
rodič
revize
410317af7e
1 změnil soubory, kde provedl 4 přidání a 2 odebrání
  1. 4 2
      core/hdd/src/wlan_hdd_regulatory.c

+ 4 - 2
core/hdd/src/wlan_hdd_regulatory.c

@@ -900,6 +900,7 @@ void hdd_reg_notifier(struct wiphy *wiphy,
 {
 	QDF_STATUS status = QDF_STATUS_SUCCESS;
 	struct hdd_context *hdd_ctx = wiphy_priv(wiphy);
+	char country[REG_ALPHA2_LEN + 1] = {0};
 
 	hdd_debug("country: %c%c, initiator %d, dfs_region: %d",
 		  request->alpha2[0],
@@ -909,8 +910,9 @@ void hdd_reg_notifier(struct wiphy *wiphy,
 
 	switch (request->initiator) {
 	case NL80211_REGDOM_SET_BY_USER:
-		status = ucfg_reg_set_country(hdd_ctx->hdd_pdev,
-					      request->alpha2);
+		qdf_mem_copy(country, request->alpha2, QDF_MIN(
+			     sizeof(request->alpha2), sizeof(country)));
+		status = ucfg_reg_set_country(hdd_ctx->hdd_pdev, country);
 		break;
 	case NL80211_REGDOM_SET_BY_CORE:
 	case NL80211_REGDOM_SET_BY_COUNTRY_IE: