From 391b6eea59269ce8962c2ae160de6c8ac8bb4967 Mon Sep 17 00:00:00 2001 From: Srinivas Girigowda Date: Mon, 21 Nov 2016 19:05:28 -0800 Subject: [PATCH] qcacld-2.0: Validate "set passpoint list" network count Currently when processing the "set passpoint list" vendor command the "number of networks" parameter is not limit checked. This value is subsequently used to calculate the size of a buffer. Add a limit check to ensure that an appropriately sized buffer is always allocated. Change-Id: Ibc2346b8a62898fc47e2d1efe457c57c08b0cada CRs-Fixed: 1091940 Bug: 32879283 Signed-off-by: Srinivas Girigowda --- drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_cfg80211.c | 7 ++++++- drivers/staging/qcacld-2.0/CORE/MAC/inc/sirApi.h | 1 + 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_cfg80211.c b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_cfg80211.c index e628b575350e4..82275c27ae587 100644 --- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_cfg80211.c +++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_cfg80211.c @@ -5111,8 +5111,13 @@ static int __wlan_hdd_cfg80211_set_passpoint_list(struct wiphy *wiphy, } num_networks = nla_get_u32( tb[QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_LIST_PARAM_NUM]); - hddLog(LOG1, FL("num networks %u"), num_networks); + if (num_networks > SIR_PASSPOINT_LIST_MAX_NETWORKS) { + hddLog(LOGE, FL("num networks %u exceeds max %u"), + num_networks, SIR_PASSPOINT_LIST_MAX_NETWORKS); + return -EINVAL; + } + hddLog(LOG1, FL("num networks %u"), num_networks); req_msg = vos_mem_malloc(sizeof(*req_msg) + (num_networks * sizeof(req_msg->networks[0]))); if (!req_msg) { diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/inc/sirApi.h b/drivers/staging/qcacld-2.0/CORE/MAC/inc/sirApi.h index e6ff7c0967ddb..34287b3c3095d 100644 --- a/drivers/staging/qcacld-2.0/CORE/MAC/inc/sirApi.h +++ b/drivers/staging/qcacld-2.0/CORE/MAC/inc/sirApi.h @@ -5580,6 +5580,7 @@ struct wifi_epno_params struct wifi_epno_network networks[]; }; +#define SIR_PASSPOINT_LIST_MAX_NETWORKS 8 #define SIR_PASSPOINT_REALM_LEN 256 #define SIR_PASSPOINT_ROAMING_CONSORTIUM_ID_NUM 16 #define SIR_PASSPOINT_PLMN_LEN 3