diff options
| author | Jerry Lee <jerrylee@broadcom.com> | 2016-07-08 15:40:24 -0700 |
|---|---|---|
| committer | Tasayco Loarte, VictorX <victorx.tasayco.loarte@intel.com> | 2016-09-26 11:21:12 +0100 |
| commit | 0ec28577a581ee07c7e9586a019d05f856d39497 (patch) | |
| tree | 398456ca21af663db4cbd76eca4b1455f52c52b1 /drivers | |
| parent | 98d35527ca1d1b3f9fd68787cfbc9c8104fba7b9 (diff) | |
| download | x86-0ec28577a581ee07c7e9586a019d05f856d39497.tar.gz | |
net: wireless: bcmdhd: security vulnerability - protect array overflow in PNO
Protect array overflow in parsing PNO batching cmd
Bug: 29009982
Bug: 31554728
Change-Id: I4e36f580336cacd6e3efcb8caf91eef33003753b
Tracked-On: https://jira01.devtools.intel.com/browse/AW-1795
Signed-off-by: Jerry Lee <jerrylee@broadcom.com>
Signed-off-by: Victor Tasayco Loarte <victorx.tasayco.loarte@intel.com>
Diffstat (limited to 'drivers')
| -rw-r--r-- | drivers/net/wireless/bcmdhd/wl_android.c | 20 |
1 files changed, 14 insertions, 6 deletions
diff --git a/drivers/net/wireless/bcmdhd/wl_android.c b/drivers/net/wireless/bcmdhd/wl_android.c index 39c52dd23d10..de75a3c2ce55 100644 --- a/drivers/net/wireless/bcmdhd/wl_android.c +++ b/drivers/net/wireless/bcmdhd/wl_android.c @@ -685,8 +685,9 @@ wls_parse_batching_cmd(struct net_device *dev, char *command, int total_len) " <> params\n", __FUNCTION__)); goto exit; } - while ((token2 = strsep(&pos2, - PNO_PARAM_CHANNEL_DELIMETER)) != NULL) { + + while ((token2 = strsep(&pos2, PNO_PARAM_CHANNEL_DELIMETER)) + != NULL) { if (token2 == NULL || !*token2) break; if (*token2 == '\0') @@ -697,13 +698,20 @@ wls_parse_batching_cmd(struct net_device *dev, char *command, int total_len) DHD_PNO(("band : %s\n", (*token2 == 'A')? "A" : "B")); } else { + if ((batch_params.nchan >= WL_NUMCHANNELS) || + (i >= WL_NUMCHANNELS)) { + DHD_ERROR(("Too many nchan %d\n", + batch_params.nchan)); + err = BCME_BUFTOOSHORT; + goto exit; + } batch_params.chan_list[i++] = - simple_strtol(token2, NULL, 0); + simple_strtol(token2, NULL, 0); batch_params.nchan++; - DHD_PNO(("channel :%d\n", - batch_params.chan_list[i-1])); + DHD_PNO(("channel: %d\n", + batch_params.chan_list[i-1])); } - } + } } else if (!strncmp(param, PNO_PARAM_RTT, strlen(PNO_PARAM_RTT))) { batch_params.rtt = simple_strtol(value, NULL, 0); DHD_PNO(("rtt : %d\n", batch_params.rtt)); |