Browse Source

qcacld-3.0: Prevent buffer overflow in QCSAP_IOCTL_VERSION

qcacld-2.0 to qcacld-3.0 propagation

The QCSAP_IOCTL_VERSION IOCTL is registered with a maximum GET
buffer length of QCSAP_MAX_SC_IE = 256 bytes. But while filling
buffer, Host allows to fill till WE_MAX_STR_LEN which may lead to
buffer overflow.
As a part of this fix, Host ensure to register with maximum
WE_MAX_STR_LEN buffer length.

Change-Id: I5ba0268e978c7ddadabc96a4eba18140ff7db3c6
CRs-Fixed: 1001142
(cherry picked from commit 85f4f75e8396e27467716555d68b3a18dd57b6fe)
Mukul Sharma 8 năm trước cách đây
mục cha
commit
dd93cbca9e
1 tập tin đã thay đổi với 1 bổ sung1 xóa
  1. 1 1
      core/hdd/src/wlan_hdd_hostapd.c

+ 1 - 1
core/hdd/src/wlan_hdd_hostapd.c

@@ -6035,7 +6035,7 @@ static const struct iw_priv_args hostapd_private_args[] = {
 		QCSAP_IOCTL_STOPBSS, IW_PRIV_TYPE_BYTE | IW_PRIV_SIZE_FIXED, 0,
 		"stopbss"
 	}, {
-		QCSAP_IOCTL_VERSION, 0, IW_PRIV_TYPE_CHAR | QCSAP_MAX_WSC_IE,
+		QCSAP_IOCTL_VERSION, 0, IW_PRIV_TYPE_CHAR | WE_MAX_STR_LEN,
 		"version"
 	}, {
 		QCSAP_IOCTL_GET_STA_INFO, 0,