commit 6da525db9415869425ddcd3dc75b75ad1cb4c1cb
author Ratnam Rachuri <c_rrachu@qti.qualcomm.com> Fri Aug 07 13:55:54 2015 +0530
committer Satyanarayana Dash <sadash@codeaurora.org> Fri Aug 07 19:21:19 2015 +0530
tree ee8741c9e2c1ceae7e0558121797e5205d7270fa
parent b205aa84787625bb331c9de62d2bd97378cd801b

prima: Fix buffer overwrite problem in GETSCANNPROBES

qcacld-2.0 to prima propagation

If (len + 1) is greater than priv_data.total_len then copy_to_user
results in writing more data than the buffer can hold.
Fix this by writing mininum of (len + 1) and priv_data.total_len

CRs-Fixed: 865551
Change-Id: Id1bf57ac345bc5bbd48fb19e60e54b6c2779d0cd

CORE/HDD/src/wlan_hdd_main.c

diff --git a/CORE/HDD/src/wlan_hdd_main.c b/CORE/HDD/src/wlan_hdd_main.c
index 5d1c8a0..24bd8c6 100755
--- a/CORE/HDD/src/wlan_hdd_main.c
+++ b/CORE/HDD/src/wlan_hdd_main.c
@@ -3314,8 +3314,8 @@
            tANI_U8 len = 0;
 
            len = scnprintf(extra, sizeof(extra), "%s %d", command, val);
-           if (copy_to_user(priv_data.buf, &extra, len + 1))
-           {
+           len = VOS_MIN(priv_data.total_len, len + 1);
+           if (copy_to_user(priv_data.buf, &extra, len)) {
                VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
                   "%s: failed to copy data to user buffer", __func__);
                ret = -EFAULT;