diff options
| author | gaurank kathpalia <gkathpal@codeaurora.org> | 2018-08-14 17:39:48 +0530 |
|---|---|---|
| committer | firebird11 <hbgassel@gmail.com> | 2018-11-29 20:11:12 +0100 |
| commit | e0ac244f5a4e57460ac6cf0e3df0e0b999791556 (patch) | |
| tree | 839226f061c1673c9542f044c80f406e636a39b2 | |
| parent | a2ced5f144e2c93cbe9bf2c3d59ad622d341873e (diff) | |
wlan: Increase size of MAX_WPA_RSN_IE_LEN in wlan_hdd_cfg80211_set_ie
In function wlan_hdd_cfg80211_set_ie, RSN IE is parsed and copied
into the buffer pWextState->WPARSNIE for length eLen + 2.
However, the buffer WPARSNIE is allocated only for MAX_WPA_RSN_IE_LEN
size. If eLen + 2 is greater than MAX_WPA_RSN_IE_LEN, a buffer overflow
would occur.
Increase the size of MAX_WPA_RSN_IE_LEN to 255 as per the spec
Change-Id: Ibf44e8dc1010e6e32b2262357d3aa180926d5c99
CRs-Fixed: 2299183
| -rw-r--r-- | drivers/staging/prima/CORE/HDD/inc/wlan_hdd_wext.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/drivers/staging/prima/CORE/HDD/inc/wlan_hdd_wext.h b/drivers/staging/prima/CORE/HDD/inc/wlan_hdd_wext.h index 1ae88c8448e..7cb1898e0cd 100644 --- a/drivers/staging/prima/CORE/HDD/inc/wlan_hdd_wext.h +++ b/drivers/staging/prima/CORE/HDD/inc/wlan_hdd_wext.h @@ -176,7 +176,7 @@ typedef enum #define IE_VENDOR_OUI_SIZE 4 /** Maximum Length of WPA/RSN IE */ -#define MAX_WPA_RSN_IE_LEN 40 +#define MAX_WPA_RSN_IE_LEN 255 /** Maximum Number of WEP KEYS */ #define MAX_WEP_KEYS 4 |