wlan: Fix buffer overwrite problem in GETCCXMODE
If (len + 1) is greater than priv_data.total_len then copy_to_user
results in writing more data than the buffer can hold.
Fix this by writing mininum of (len + 1) and priv_data.total_len.
Change-Id: Ibb765d280ee69930feee4aa221e30443d957f308
CRs-Fixed: 865574
diff --git a/CORE/HDD/src/wlan_hdd_main.c b/CORE/HDD/src/wlan_hdd_main.c
index bc8aaeb..eca9d6c 100755
--- a/CORE/HDD/src/wlan_hdd_main.c
+++ b/CORE/HDD/src/wlan_hdd_main.c
@@ -2851,7 +2851,8 @@
len = scnprintf(extra, sizeof(extra), "%s %d",
"GETCCXMODE", eseMode);
- if (copy_to_user(priv_data.buf, &extra, len + 1))
+ len = VOS_MIN(priv_data.total_len, len + 1);
+ if (copy_to_user(priv_data.buf, &extra, len))
{
VOS_TRACE( VOS_MODULE_ID_HDD, VOS_TRACE_LEVEL_ERROR,
"%s: failed to copy data to user buffer", __func__);