mirror of
https://github.com/Divested-Mobile/DivestOS-Build.git
synced 2024-10-01 01:35:54 -04:00
51 lines
2.2 KiB
Diff
51 lines
2.2 KiB
Diff
|
From 391b6eea59269ce8962c2ae160de6c8ac8bb4967 Mon Sep 17 00:00:00 2001
|
||
|
|
From: Srinivas Girigowda <sgirigow@codeaurora.org>
|
||
|
|
Date: Mon, 21 Nov 2016 19:05:28 -0800
|
||
|
|
Subject: [PATCH] qcacld-2.0: Validate "set passpoint list" network count
|
||
|
|
|
||
|
|
Currently when processing the "set passpoint list" vendor command the
|
||
|
|
"number of networks" parameter is not limit checked. This value is
|
||
|
|
subsequently used to calculate the size of a buffer. Add a limit check
|
||
|
|
to ensure that an appropriately sized buffer is always allocated.
|
||
|
|
|
||
|
|
Change-Id: Ibc2346b8a62898fc47e2d1efe457c57c08b0cada
|
||
|
|
CRs-Fixed: 1091940
|
||
|
|
Bug: 32879283
|
||
|
|
Signed-off-by: Srinivas Girigowda <sgirigow@codeaurora.org>
|
||
|
|
---
|
||
|
|
drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_cfg80211.c | 7 ++++++-
|
||
|
|
drivers/staging/qcacld-2.0/CORE/MAC/inc/sirApi.h | 1 +
|
||
|
|
2 files changed, 7 insertions(+), 1 deletion(-)
|
||
|
|
|
||
|
|
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_cfg80211.c b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_cfg80211.c
|
||
|
|
index e628b575350e4..82275c27ae587 100644
|
||
|
|
--- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_cfg80211.c
|
||
|
|
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_cfg80211.c
|
||
|
|
@@ -5111,8 +5111,13 @@ static int __wlan_hdd_cfg80211_set_passpoint_list(struct wiphy *wiphy,
|
||
|
|
}
|
||
|
|
num_networks = nla_get_u32(
|
||
|
|
tb[QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_LIST_PARAM_NUM]);
|
||
|
|
- hddLog(LOG1, FL("num networks %u"), num_networks);
|
||
|
|
+ if (num_networks > SIR_PASSPOINT_LIST_MAX_NETWORKS) {
|
||
|
|
+ hddLog(LOGE, FL("num networks %u exceeds max %u"),
|
||
|
|
+ num_networks, SIR_PASSPOINT_LIST_MAX_NETWORKS);
|
||
|
|
+ return -EINVAL;
|
||
|
|
+ }
|
||
|
|
|
||
|
|
+ hddLog(LOG1, FL("num networks %u"), num_networks);
|
||
|
|
req_msg = vos_mem_malloc(sizeof(*req_msg) +
|
||
|
|
(num_networks * sizeof(req_msg->networks[0])));
|
||
|
|
if (!req_msg) {
|
||
|
|
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/inc/sirApi.h b/drivers/staging/qcacld-2.0/CORE/MAC/inc/sirApi.h
|
||
|
|
index e6ff7c0967ddb..34287b3c3095d 100644
|
||
|
|
--- a/drivers/staging/qcacld-2.0/CORE/MAC/inc/sirApi.h
|
||
|
|
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/inc/sirApi.h
|
||
|
|
@@ -5580,6 +5580,7 @@ struct wifi_epno_params
|
||
|
|
struct wifi_epno_network networks[];
|
||
|
|
};
|
||
|
|
|
||
|
|
+#define SIR_PASSPOINT_LIST_MAX_NETWORKS 8
|
||
|
|
#define SIR_PASSPOINT_REALM_LEN 256
|
||
|
|
#define SIR_PASSPOINT_ROAMING_CONSORTIUM_ID_NUM 16
|
||
|
|
#define SIR_PASSPOINT_PLMN_LEN 3
|