wlan: Avoid buffer overflow.
scnprintf returns the number of characters
which are actually written in the buffer.
Currently there is no check, while filling
buffer. Hence a situation might arise where
the len is greater than the sizeof of buffer.
Latter on this buffer is copied to user space
through api copy_to_user and since the len
is greater than buffer size, buffer over-flow
would occur. As a part of fix, make sure that
buffer over doesn't occur.
Change-Id: I652979cb26fd7fff36ee54f9ec60132453ac7913
CRs-Fixed: 908252
diff --git a/CORE/HDD/src/wlan_hdd_main.c b/CORE/HDD/src/wlan_hdd_main.c
index c150dae..05bf8f4 100755
--- a/CORE/HDD/src/wlan_hdd_main.c
+++ b/CORE/HDD/src/wlan_hdd_main.c
@@ -2872,7 +2872,7 @@
[Number of roam scan channels][Channel1][Channel2]... */
/* copy the number of channels in the 0th index */
len = scnprintf(extra, sizeof(extra), "%s %d", command, numChannels);
- for (j = 0; (j < numChannels); j++)
+ for (j = 0; (j < numChannels) && len <= sizeof(extra); j++)
{
len += scnprintf(extra + len, sizeof(extra) - len, " %d",
ChannelList[j]);