From 8d7be2d642a1fa4a863d0f7d49b2e60c0aaa497f Mon Sep 17 00:00:00 2001 From: Jeff Johnson Date: Thu, 15 Jun 2017 10:51:02 -0700 Subject: [PATCH] prima: Avoid overread when configuring MAC addresses Currently there are multiple cfg80211 vendor commands where MAC address attributes are defined in a nla_policy table with a type of NLA_UNSPEC but without a minimum length. Add the proper minimum length to avoid buffer overread. Change-Id: I11e1205943147102a536ca462fbdba7c826dd195 CRs-Fixed: 2061251 [GabrieleM: Partially applied with 3617aa44129c503af51f4f0537b9c6866] --- drivers/staging/prima/CORE/HDD/src/wlan_hdd_cfg80211.c | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/drivers/staging/prima/CORE/HDD/src/wlan_hdd_cfg80211.c b/drivers/staging/prima/CORE/HDD/src/wlan_hdd_cfg80211.c index d64f2eb036d..729d2d77254 100644 --- a/drivers/staging/prima/CORE/HDD/src/wlan_hdd_cfg80211.c +++ b/drivers/staging/prima/CORE/HDD/src/wlan_hdd_cfg80211.c @@ -2158,8 +2158,9 @@ wlan_hdd_extscan_config_policy [QCA_WLAN_VENDOR_ATTR_EXTSCAN_GET_CACHED_SCAN_RESULTS_CONFIG_PARAM_MAX] = { .type = NLA_U32 }, - [QCA_WLAN_VENDOR_ATTR_EXTSCAN_AP_THRESHOLD_PARAM_BSSID] = - { .type = NLA_UNSPEC }, + [QCA_WLAN_VENDOR_ATTR_EXTSCAN_AP_THRESHOLD_PARAM_BSSID] = { + .type = NLA_UNSPEC, + .len = HDD_MAC_ADDR_LEN}, [QCA_WLAN_VENDOR_ATTR_EXTSCAN_AP_THRESHOLD_PARAM_RSSI_LOW] = { .type = NLA_S32 }, [QCA_WLAN_VENDOR_ATTR_EXTSCAN_AP_THRESHOLD_PARAM_RSSI_HIGH] =