commit a3739746d7e3efa594e4f6462f8da7dbb88ac3ff
author Manjeet Singh <c_manjee@qti.qualcomm.com> Tue May 03 16:21:46 2016 +0530
committer Satyanarayana Dash <sadash@codeaurora.org> Wed May 04 15:34:57 2016 +0530
tree 7ce32c6a4d3325b8e18fd0ab4b6ae58537b07cae
parent c4abdfdb9e8f4f02e4345bad35b7f4ca0e771874

wlan: fix buffer overflow in linkspeed ioctl

cld to prima propagation.

In linkspeed ioctl handler, mac address array is allocated a
size of MAC_ADDRESS_STR_LEN, which is 18 bytes taking account of null
terminator '\0'. But in code, a null terminator is being manually added
at index MAC_ADDRESS_STR_LEN. This would overflow the buffer and hence
null terminator should be added at MAC_ADDRESS_STR_LEN -1.

Change-Id: I16c2d0f787dfa339780db7d888aff37355c32322
CRs-fixed: 1000861

CORE/HDD/src/wlan_hdd_hostapd.c

diff --git a/CORE/HDD/src/wlan_hdd_hostapd.c b/CORE/HDD/src/wlan_hdd_hostapd.c
index a9167f3..03889a4 100644
--- a/CORE/HDD/src/wlan_hdd_hostapd.c
+++ b/CORE/HDD/src/wlan_hdd_hostapd.c
@@ -4662,7 +4662,7 @@
            kfree(pmacAddress);
            return -EFAULT;
        }
-       pmacAddress[MAC_ADDRESS_STR_LEN] = '\0';
+       pmacAddress[MAC_ADDRESS_STR_LEN-1] = '\0';
 
        status = hdd_string_to_hex (pmacAddress, MAC_ADDRESS_STR_LEN, macAddress );
        kfree(pmacAddress);