Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 6a882c46 authored by VIJAY RAJ's avatar VIJAY RAJ Committed by Madan Koyyalamudi
Browse files

qcacld-3.0: Fix buffer overflow in pe_filter_bcn_probe_frame() 

In pe_filter_bcn_probe_frame(), the value of bcn_ssid.length
could be greater than WLAN_SSID_MAX_LEN.

Added a check to prevent possible buffer overflow

Change-Id: I4a5247e9ea8a1c14335935cbe0739fb21a34d1ef
CRs-Fixed: 3028274
parent 7a8e4dfa

core/mac/src/pe/lim/lim_api.c

+3 −0
Original line number Diff line number Diff line
@@ -1179,6 +1179,9 @@ static bool pe_filter_bcn_probe_frame(struct mac_context *mac_ctx, 
			return false;



		bcn_ssid.length = ssid_ie[1];

		if (bcn_ssid.length > WLAN_SSID_MAX_LEN)

			return false;



		qdf_mem_copy(&bcn_ssid.ssId,

			     &ssid_ie[2],

			     bcn_ssid.length);