wlan: Fix buffer overrun in function ProcSetReqInternal
In function ProcSetReqInternal, valueLen is obtained from the
message buffer pParam. This valueLen is used as argument to the
function GetStrValue where the contents of the buffer pParam is
copied to pMac->cfg.gSBuffer for valueLen number of bytes. However
the array pMac->cfg.gSBuffer is a static array of size CFG_MAX_STR_LEN.
If the value of valueLen exceeds CFG_MAX_STR_LEN, a buffer overwrite
will occur in GetStrValue.
Add Sanity check to make sure valueLen does not exceed CFG_MAX_STR_LEN.
Issue: SEC-1084
Change-Id: I7464336046def5213ab564575ab9fa27a03728b2
CRs-Fixed: 2143847
Signed-off-by: Gururaj Patil <gururaj.patil3@harman.com>
1 file changed