Explorar o código

qcacld-3.0: Avoid buffer overflow

Add max check for probe request length against max length of probe
request buffer to avoid buffer overflow.

Change-Id: Ie0fad7443b2c749c66bb9ad662625a16d3a840c3
CRs-Fixed: 2138555
Padma, Santhosh Kumar %!s(int64=7) %!d(string=hai) anos
pai
achega
8472cb885f
Modificáronse 1 ficheiros con 7 adicións e 0 borrados
  1. 7 0
      core/mac/src/pe/lim/lim_process_probe_req_frame.c

+ 7 - 0
core/mac/src/pe/lim/lim_process_probe_req_frame.c

@@ -665,6 +665,13 @@ lim_send_sme_probe_req_ind(tpAniSirGlobal pMac,
 
 	MTRACE(mac_trace(pMac, TRACE_CODE_TX_SME_MSG,
 				psessionEntry->peSessionId, msgQ.type));
+
+	if (ProbeReqIELen > sizeof(pSirSmeProbeReqInd->WPSPBCProbeReq.
+	    probeReqIE)) {
+		ProbeReqIELen = sizeof(pSirSmeProbeReqInd->WPSPBCProbeReq.
+				       probeReqIE);
+	}
+
 	pSirSmeProbeReqInd->WPSPBCProbeReq.probeReqIELen =
 		(uint16_t) ProbeReqIELen;
 	qdf_mem_copy(pSirSmeProbeReqInd->WPSPBCProbeReq.probeReqIE, pProbeReqIE,