diff options
| author | Vignesh Viswanathan <viswanat@codeaurora.org> | 2017-11-28 17:39:08 +0530 |
|---|---|---|
| committer | Oleg Matcovschi <omatcovschi@google.com> | 2018-03-15 15:24:47 -0700 |
| commit | a09b4dae9532577cd3e5f695eb48f6227f4deb59 (patch) | |
| tree | 8848c6beb00f58e684b78e404f021ed2590b3798 /net/lapb/lapb_timer.c | |
| parent | e3fe205ff146d67d8f3515dde9371c27a5e5f2b5 (diff) | |
qcacld-3.0: Fix buffer overwrite due to ssid_len in WMA handlers
In multiple WMA event handler functions, ssid_len is used to copy
ssid from FW buffer to local buffer and ssid_len value is received
from the FW. If the ssid_len value exceeds SIR_MAC_MAX_SSID_LENGTH
then a buffer overwrite would occur.
Add sanity check for ssid_len against SIR_MAC_MAX_SSID_LENGTH in
multiple WMA handler functions
Bug: 72956801
Change-Id: I9e4b1f88c275093b4912496cdb936cf54a8880a2
CRs-Fixed: 2149531
Signed-off-by: Ecco Park <eccopark@google.com>
Diffstat (limited to 'net/lapb/lapb_timer.c')
0 files changed, 0 insertions, 0 deletions