Merge 9fa5d927b07a5c502ad4c41ca63baf7f799697d7 on remote branch
Change-Id: Icd22053385e6a4deaa1b75f4987b05b65f9c37c6
diff --git a/qcwcn/wpa_supplicant_8_lib/driver_cmd_nl80211.c b/qcwcn/wpa_supplicant_8_lib/driver_cmd_nl80211.c
index 949ba91..bc5f5a1 100644
--- a/qcwcn/wpa_supplicant_8_lib/driver_cmd_nl80211.c
+++ b/qcwcn/wpa_supplicant_8_lib/driver_cmd_nl80211.c
@@ -1540,6 +1540,12 @@
android_wifi_priv_cmd priv_cmd;
memset(&ifr, 0, sizeof(ifr));
memset(&priv_cmd, 0, sizeof(priv_cmd));
+
+ if (strlen(cmd) + 1 > buf_len) {
+ wpa_printf(MSG_ERROR, "%s: cmd length is invalid\n",
+ __func__);
+ return -EINVAL;
+ }
os_memcpy(buf, cmd, strlen(cmd) + 1);
strlcpy(ifr.ifr_name, bss->ifname, IFNAMSIZ);
priv_cmd.buf = buf;
@@ -2595,6 +2601,12 @@
} else { /* Use private command */
memset(&ifr, 0, sizeof(ifr));
memset(&priv_cmd, 0, sizeof(priv_cmd));
+
+ if (strlen(cmd) + 1 > buf_len) {
+ wpa_printf(MSG_ERROR, "%s: cmd length is invalid\n",
+ __func__);
+ return -EINVAL;
+ }
os_memcpy(buf, cmd, strlen(cmd) + 1);
os_strlcpy(ifr.ifr_name, bss->ifname, IFNAMSIZ);