From cbfc7fd3baa2b525bf0534f678a59c2e4c88c71c Mon Sep 17 00:00:00 2001 From: dataanddreams Date: Fri, 4 Dec 2015 10:28:53 -0500 Subject: net: wireless: bcmdhd: Add checks for stack buffer overflows These two checks prevent exploitable buffer overflows in two scenarios. 1. Long WPS_ID_DEVICE_NAME in WPS info elements 2. Invalid SSID determined in certain scan results Bug: 25661991 Change-Id: I356c71b3ccda765b03a1a380c39e199c3c3e3261 Signed-off-by: Yuan Lin --- drivers/net/wireless/bcmdhd/wl_cfg80211.c | 5 ----- 1 file changed, 5 deletions(-) diff --git a/drivers/net/wireless/bcmdhd/wl_cfg80211.c b/drivers/net/wireless/bcmdhd/wl_cfg80211.c index 5073913..ba000ef 100644 --- a/drivers/net/wireless/bcmdhd/wl_cfg80211.c +++ b/drivers/net/wireless/bcmdhd/wl_cfg80211.c @@ -9095,11 +9095,6 @@ wl_notify_sched_scan_results(struct bcm_cfg80211 *cfg, struct net_device *ndev, memcpy(ssid[i].ssid, netinfo->pfnsubnet.SSID, ssid[i].ssid_len); request->n_ssids++; - memcpy(ssid[i].ssid, netinfo->pfnsubnet.SSID, - netinfo->pfnsubnet.SSID_len); - ssid[i].ssid_len = netinfo->pfnsubnet.SSID_len; - request->n_ssids++; - channel_req = netinfo->pfnsubnet.channel; band = (channel_req <= CH_MAX_2G_CHANNEL) ? NL80211_BAND_2GHZ : NL80211_BAND_5GHZ; -- cgit v1.1