Browse Source

qcacld 3.0: Address buffer overflow due to invalid length

qcacld-2.0 to qcacld-3.0 propagation
Check for valid length before copying the packet filter data from
userspace buffer to kernel space buffer to avoid buffer overflow
issue.

Change-Id: I9548727543b903b5eaafa25c6184615d511ca99d
CRs-Fixed: 930533
Rajeev Kumar 9 years ago
parent
commit
f5b6da2359
1 changed files with 7 additions and 0 deletions
  1. 7 0
      core/hdd/src/wlan_hdd_wext.c

+ 7 - 0
core/hdd/src/wlan_hdd_wext.c

@@ -8921,6 +8921,13 @@ static int wlan_hdd_set_filter(hdd_context_t *hdd_ctx,
 				request->params_data[i].data_offset,
 				request->params_data[i].data_length);
 
+			if (sizeof(packetFilterSetReq.paramsData[i].compareData)
+				< (request->params_data[i].data_length)) {
+				hdd_err("Error invalid data length %d",
+					request->params_data[i].data_length);
+				return -EINVAL;
+			}
+
 			memcpy(&packetFilterSetReq.paramsData[i].compareData,
 			       request->params_data[i].compare_data,
 			       request->params_data[i].data_length);