소스 검색

qcacld-3.0: Avoid buffer overflow

Add max check for probe request length against max length of probe
request buffer to avoid buffer overflow.

Change-Id: Ie0fad7443b2c749c66bb9ad662625a16d3a840c3
CRs-Fixed: 2138555
Padma, Santhosh Kumar 7 년 전
부모
커밋
8472cb885f
1개의 변경된 파일7개의 추가작업 그리고 0개의 파일을 삭제
  1. 7 0
      core/mac/src/pe/lim/lim_process_probe_req_frame.c

+ 7 - 0
core/mac/src/pe/lim/lim_process_probe_req_frame.c

@@ -665,6 +665,13 @@ lim_send_sme_probe_req_ind(tpAniSirGlobal pMac,
 
 	MTRACE(mac_trace(pMac, TRACE_CODE_TX_SME_MSG,
 				psessionEntry->peSessionId, msgQ.type));
+
+	if (ProbeReqIELen > sizeof(pSirSmeProbeReqInd->WPSPBCProbeReq.
+	    probeReqIE)) {
+		ProbeReqIELen = sizeof(pSirSmeProbeReqInd->WPSPBCProbeReq.
+				       probeReqIE);
+	}
+
 	pSirSmeProbeReqInd->WPSPBCProbeReq.probeReqIELen =
 		(uint16_t) ProbeReqIELen;
 	qdf_mem_copy(pSirSmeProbeReqInd->WPSPBCProbeReq.probeReqIE, pProbeReqIE,