commit d64d52368966d4368be534898ee1a18b126ba4a2
author Anurag Chouhan <achouhan@qti.qualcomm.com> Mon Aug 29 17:01:38 2016 +0530
committer Satyanarayana Dash <sadash@codeaurora.org> Fri Sep 02 21:59:22 2016 +0530
tree feecd17722fcd92effb8182295225e133e9c7325
parent 9dfb9c7a4228604a3fcc9741febfbb4d2646b08a

prima: Add check to Validate SSID length

Validate ssid length before accessing the ssid
if the length exceeds max ssid length then return.

Change-Id: I6902a8a3edf6547cf30d37fe5e435ad4f226ac46
CRs-Fixed: 1059205

CORE/HDD/src/wlan_hdd_cfg80211.c

diff --git a/CORE/HDD/src/wlan_hdd_cfg80211.c b/CORE/HDD/src/wlan_hdd_cfg80211.c
index 1158afd..9e7a3b4 100644
--- a/CORE/HDD/src/wlan_hdd_cfg80211.c
+++ b/CORE/HDD/src/wlan_hdd_cfg80211.c
@@ -3902,6 +3902,7 @@
     uint32_t request_id;
     char ssid_string[SIR_MAC_MAX_SSID_LENGTH + 1] = {'\0'};
     int ssid_len;
+    int ssid_length;
     eHalStatus status;
     int i, rem, retval;
     unsigned long rc;
@@ -3992,12 +3993,15 @@
             hddLog(LOGE, FL("attr ssid failed"));
             goto fail;
         }
-        nla_memcpy(ssid_string,
-               tb2[PARAM_SSID],
-               sizeof(ssid_string));
+        ssid_length = nla_strlcpy(ssid_string, tb2[PARAM_SSID],
+                                  sizeof(ssid_string));
         hddLog(LOG1, FL("SSID %s"),
                ssid_string);
         ssid_len = strlen(ssid_string);
+        if (ssid_length > SIR_MAC_MAX_SSID_LENGTH) {
+                hddLog(LOGE, FL("Invalid ssid length"));
+                goto fail;
+        }
         memcpy(request->ssid[i].ssid.ssId, ssid_string, ssid_len);
         request->ssid[i].ssid.length = ssid_len;
         request->ssid[i].ssid.ssId[ssid_len] = '\0';