Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 889cb360 authored by Eliad Peller's avatar Eliad Peller Committed by Luciano Coelho
Browse files

wl12xx: simplify wl1271_ssid_set() 



Simplify wl1271_ssid_set by re-using cfg80211_find_ie instead of
reimplementing it.

Additionally, add a length check to prevent a potential buffer overflow.

Signed-off-by: default avatarEliad Peller <eliad@wizery.com>
Signed-off-by: default avatarLuciano Coelho <coelho@ti.com>
parent 6b86bd62

drivers/net/wireless/wl12xx/main.c

+15 −11
Original line number Diff line number Diff line
@@ -2376,20 +2376,24 @@ static int wl1271_op_set_rts_threshold(struct ieee80211_hw *hw, u32 value) 
static int wl1271_ssid_set(struct wl1271 *wl, struct sk_buff *skb,

			    int offset)

{

	u8 *ptr = skb->data + offset;

	u8 ssid_len;

	const u8 *ptr = cfg80211_find_ie(WLAN_EID_SSID, skb->data + offset,

					 skb->len - offset);



	/* find the location of the ssid in the beacon */

	while (ptr < skb->data + skb->len) {

		if (ptr[0] == WLAN_EID_SSID) {

			wl->ssid_len = ptr[1];

			memcpy(wl->ssid, ptr+2, wl->ssid_len);

			return 0;

	if (!ptr) {

		wl1271_error("No SSID in IEs!");

		return -ENOENT;

	}

		ptr += (ptr[1] + 2);



	ssid_len = ptr[1];

	if (ssid_len > IEEE80211_MAX_SSID_LEN) {

		wl1271_error("SSID is too long!");

		return -EINVAL;

	}



	wl1271_error("No SSID in IEs!\n");

	return -ENOENT;

	wl->ssid_len = ssid_len;

	memcpy(wl->ssid, ptr+2, ssid_len);

	return 0;

}



static int wl1271_bss_erp_info_changed(struct wl1271 *wl,