lisa/android_kernel_xiaomi_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacld-3.0: Reject NULL SSID for SSID white list

Browse Source 
For vendor command QCA_NL80211_VENDOR_SUBCMD_ROAM with sub command
QCA_WLAN_VENDOR_ATTR_ROAM_SUBCMD_SSID_WHITE_LIST, NULL SSID with
NULL terminal can be accepted since it only requires non-zero
buffer len. Should only accept buffer len greater than 1.

Change-Id: I87144d4bf169e637756a4715c7a596c32f49dc36
CRs-Fixed: 2454035
This commit is contained in:
Min Liu 2019-05-16 18:48:41 +08:00 committed by nshrivas
parent 75d4b7d4cd
commit dd30889709
1 changed files with 6 additions and 2 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
core/hdd/src/wlan_hdd_cfg80211.c
View File

@ -3701,7 +3701,11 @@ static int hdd_set_white_list(struct hdd_context *hdd_ctx,
if (count && tb[PARAM_SSID_LIST]) {
nla_for_each_nested(curr_attr,
tb[PARAM_SSID_LIST], rem) {
tb[PARAM_SSID_LIST], rem) {
if (i == MAX_SSID_ALLOWED_LIST) {
hdd_err("Excess MAX_SSID_ALLOWED_LIST");
goto fail;
}
if (wlan_cfg80211_nla_parse(tb2,
QCA_WLAN_VENDOR_ATTR_ROAM_SUBCMD_MAX,
nla_data(curr_attr),
@ -3723,7 +3727,7 @@ static int hdd_set_white_list(struct hdd_context *hdd_ctx,
* the NULL termination character to the driver
* buffer.
*/
if (buf_len && (i < MAX_SSID_ALLOWED_LIST) &&
if (buf_len > 1 &&
((buf_len - 1) <= WLAN_SSID_MAX_LEN)) {
nla_memcpy(roam_params->ssid_allowed_list[i].ssId,
tb2[PARAM_LIST_SSID], buf_len - 1);