wlan: DroidSec string validation issues
1. the total_len is a user controlled parameter, an attacker
could pass total_len as a huge number and driver may result in
heap based overflow. Fix is to add MAX_LEN check and the value of
4096 is based on wpa_supplicant max data
2. while reading strings using sscanf buffers are allocated with
32 bytes and sscanf %32s could write 32 bytes and automatically
add a NUL termination. which could result in buffer overflow.
Fix is to read only 31 bytes and keep 1 byte for '\0'
CRs-Fixed: 594924
1 file changed