diff options
| author | Thierry Strudel <tstrudel@google.com> | 2016-04-13 10:02:35 -0700 |
|---|---|---|
| committer | Thierry Strudel <tstrudel@google.com> | 2016-04-14 15:23:46 -0700 |
| commit | c28506a3622983e3f750a9dcc856904a82717b8a (patch) | |
| tree | f118c2382f4a4b17b7d74e501e5c92ced0736304 | |
| parent | 35c3b75ed26e248c60f6491755aacf69b2ef86a4 (diff) | |
qcacld-2.0: Fix buffer overwrite problem in CCXBEACONREQandroid-6.0.1_r0.87
Set the number of IE fields to minimum of input data and
SIR_ESE_MAX_MEAS_IE_REQS.
Change-Id: Ie53cfec7872ab69530bbb8932f9f9e85fb319f92
CRs-Fixed: 993561
Bug: 27424603
Signed-off-by: Srinivas Girigowda <sgirigow@codeaurora.org>
Signed-off-by: Thierry Strudel <tstrudel@google.com>
| -rw-r--r-- | drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_main.c | 6 |
1 files changed, 3 insertions, 3 deletions
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_main.c b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_main.c index 06d129893462..48488eda7e52 100644 --- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_main.c +++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_main.c @@ -5337,17 +5337,17 @@ static VOS_STATUS hdd_parse_ese_beacon_req(tANI_U8 *pValue, /*no argument followed by spaces*/ if ('\0' == *inPtr) return -EINVAL; - /*getting the first argument ie measurement token*/ + /* Getting the first argument ie Number of IE fields */ v = sscanf(inPtr, "%31s ", buf); if (1 != v) return -EINVAL; v = kstrtos32(buf, 10, &tempInt); if ( v < 0) return -EINVAL; + tempInt = VOS_MIN(tempInt, SIR_ESE_MAX_MEAS_IE_REQS); pEseBcnReq->numBcnReqIe = tempInt; - VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_INFO_HIGH, - "Number of Bcn Req Ie fields(%d)", pEseBcnReq->numBcnReqIe); + hddLog(LOG1, "Number of Bcn Req Ie fields: %d", pEseBcnReq->numBcnReqIe); for (j = 0; j < (pEseBcnReq->numBcnReqIe); j++) { |