瀏覽代碼

qcacld-3.0: Fix out-of-bounds access while copying SSID

Issue is, if the req->ssid_len is greater than 32 then 
record->conn_info.ssid_len is limited to 32, but while copying the ssid to
the destination array, req->ssid_len is used, which may cause out of 
bounds access.

Fix is to use destination array ssid length record->conn_info.ssid_len

Change-Id: I2a661b18fc1d27eec8b2f85877681fc1b782ad39
CRs-Fixed: 3059161
David Oladunjoye 3 年之前
父節點
當前提交
f891260630
共有 1 個文件被更改,包括 2 次插入1 次删除
  1. 2 1
      core/hdd/src/wlan_hdd_connectivity_logging.c

+ 2 - 1
core/hdd/src/wlan_hdd_connectivity_logging.c

@@ -1154,7 +1154,8 @@ void wlan_hdd_connectivity_event_connecting(struct hdd_context *hdd_ctx,
 	record->conn_info.ssid_len = req->ssid_len;
 	if (req->ssid_len > WLAN_SSID_MAX_LEN)
 		record->conn_info.ssid_len = WLAN_SSID_MAX_LEN;
-	qdf_mem_copy(record->conn_info.ssid, req->ssid, req->ssid_len);
+	qdf_mem_copy(record->conn_info.ssid, req->ssid,
+		     record->conn_info.ssid_len);
 
 	if (req->bssid)
 		qdf_mem_copy(record->bssid.bytes, req->bssid,