From 90996a04c71e9f3f04ce19f523cf4e74ae2daae1 Mon Sep 17 00:00:00 2001 From: Sachin Ahuja Date: Mon, 21 Nov 2016 18:21:17 +0530 Subject: [PATCH] prima: Validate pkt buffer size. In function parse_Bufferforpkt, pkt data index is not validated. This may lead to a buffer overflow if the incoming buffer is too large. Validate packet buffer length with the total allowed pkt buffer size. Change-Id: I9b9ffa592cbe3a0d87af3cbbef3608bc59e01cfc CRs-Fixed: 1092599 --- drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c | 3 +++ 1 file changed, 3 insertions(+) diff --git a/drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c b/drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c index 6b141add087..99e0fb7b3ce 100644 --- a/drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c +++ b/drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c @@ -3859,6 +3859,9 @@ static void parse_Bufferforpkt(tSirpkt80211 *pkt, u8 *pBuffer, u16 len) length += getByte(&temp) << 8; hddLog(VOS_TRACE_LEVEL_INFO,"Payload length : %d", length); + if (length >= WLAN_DISA_MAX_PAYLOAD_SIZE) + length = WLAN_DISA_MAX_PAYLOAD_SIZE; + pkt->data.length = length; for (i = 0; i< length; i++) {