diff mbox series

[1/6] brcmfmac: assure SSID length from firmware is limited

Message ID 1550148232-4309-2-git-send-email-arend.vanspriel@broadcom.com (mailing list archive)
State Accepted
Commit 1b5e2423164b3670e8bc9174e4762d297990deff
Delegated to: Kalle Valo
Headers show
Series brcmfmac: smallish series | expand

Commit Message

Arend van Spriel Feb. 14, 2019, 12:43 p.m. UTC 
The SSID length as received from firmware should not exceed
IEEE80211_MAX_SSID_LEN as that would result in heap overflow.

Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
Reviewed-by: Franky Lin <franky.lin@broadcom.com>
Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>
---
 drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c | 2 ++
 1 file changed, 2 insertions(+)

Comments

Kalle Valo Feb. 19, 2019, 3:05 p.m. UTC | #1 
Arend van Spriel <arend.vanspriel@broadcom.com> wrote:

> The SSID length as received from firmware should not exceed
> IEEE80211_MAX_SSID_LEN as that would result in heap overflow.
> 
> Reviewed-by: Hante Meuleman <hante.meuleman@broadcom.com>
> Reviewed-by: Pieter-Paul Giesberts <pieter-paul.giesberts@broadcom.com>
> Reviewed-by: Franky Lin <franky.lin@broadcom.com>
> Signed-off-by: Arend van Spriel <arend.vanspriel@broadcom.com>

6 patches applied to wireless-drivers-next.git, thanks.

1b5e2423164b brcmfmac: assure SSID length from firmware is limited
a4176ec356c7 brcmfmac: add subtype check for event handling in data path
aaf6a5e86e36 brcmfmac: create debugfs files for bus-specific layer
92d3b88b1029 brcmfmac: disable MBSS feature for bcm4330 device
4ab2cf03da91 brcmfmac: check and dump trap info during sdio probe
a250c91c1762 brcmfmac: use chipname in brcmf_fw_alloc_request() for error path as well
diff mbox series

Patch

diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index b5e291e..012275f 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -3507,6 +3507,8 @@  static s32 brcmf_config_wowl_pattern(struct brcmf_if *ifp, u8 cmd[4],
 	}
 
 	netinfo = brcmf_get_netinfo_array(pfn_result);
+	if (netinfo->SSID_len > IEEE80211_MAX_SSID_LEN)
+		netinfo->SSID_len = IEEE80211_MAX_SSID_LEN;
 	memcpy(cfg->wowl.nd->ssid.ssid, netinfo->SSID, netinfo->SSID_len);
 	cfg->wowl.nd->ssid.ssid_len = netinfo->SSID_len;
 	cfg->wowl.nd->n_channels = 1;