Bladeren bron

qcacld-3.0: Fix buffer over read in iwpriv WE_UNIT_TEST_CMD command

qcacld-2.0 to qcacld-3.0 propagation.

In current driver, WE_UNIT_TEST_CMD has below problem.
- apps_arg[1] can have zero value and can lead to
  buffer overead

Change the code to handle the number of args if user has
given zero.

CRs-Fixed: 1029540
Change-Id: Idc8e1d77d9623daeb98d0c4b7ad8a8d6cfa9c2d2
(cherry picked from commit 063a0db662927174d22af3b78402c63d7c388112)
Anurag Chouhan 8 jaren geleden
bovenliggende
commit
77564183fc
1 gewijzigde bestanden met toevoegingen van 3 en 2 verwijderingen
  1. 3 2
      core/hdd/src/wlan_hdd_wext.c

+ 3 - 2
core/hdd/src/wlan_hdd_wext.c

@@ -8002,8 +8002,9 @@ static int __iw_set_var_ints_getnone(struct net_device *dev,
 			       apps_args[0]);
 			return -EINVAL;
 		}
-		if (apps_args[1] > (WMA_MAX_NUM_ARGS)) {
-			hdd_err("Too Many args %d",
+		if ((apps_args[1] > (WMA_MAX_NUM_ARGS)) ||
+		    (apps_args[1] < 0)) {
+			hdd_err("Too Many/Few args %d",
 			       apps_args[1]);
 			return -EINVAL;
 		}