commit dc59a8ad3d8dd8e6f298f6a3bf058dfc401e81a8
author Peter Lee Choonshong <peter.lee@hi-p.com> Thu Mar 16 10:57:50 2017 +0800
committer Gerrit Code Review <codereview@hi-p.com> Thu Mar 16 10:57:50 2017 +0800
tree a0db62f3076d970fa7f22f694cbf5e12fce54c9d
parent 7d6a1b5503b61571bde18cd0b6d1a238472ce56c
parent d833a19a9ebee9705ffb97c4e1da96a8c027456c

Merge "FPII-2973 :Denial of service vulnerability in Qualcomm Wi-Fi driver CVE-2016-10235 A-34390620 QC-CR#1046409" into fp/fp2_5.1_int

CORE/HDD/src/wlan_hdd_hostapd.c

diff --git a/CORE/HDD/src/wlan_hdd_hostapd.c b/CORE/HDD/src/wlan_hdd_hostapd.c
index 6620bc6..fda0237 100644
--- a/CORE/HDD/src/wlan_hdd_hostapd.c
+++ b/CORE/HDD/src/wlan_hdd_hostapd.c
@@ -3597,6 +3597,13 @@
         return 0;
     }
 
+    if (wrqu->data.length > DOT11F_IE_RSN_MAX_LEN) {
+       VOS_TRACE(VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
+               "%s: WPARSN Ie input length is more than max[%d]", __func__,
+                wrqu->data.length);
+       return -EINVAL;
+    }
+
     switch (genie[0]) 
     {
         case DOT11F_EID_WPA: