diff options
| author | gaurank kathpalia <gkathpal@codeaurora.org> | 2018-08-14 17:39:48 +0530 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2018-08-18 01:13:07 -0700 |
| commit | e27e355c567774d772388a2ff17e34929a9c56d0 (patch) | |
| tree | 1cf728aa181540580bb95e9ae11369977ab43914 | |
| parent | f1128f1304e5804123018f2b49201ad97aac9acc (diff) | |
| download | wlan-e27e355c567774d772388a2ff17e34929a9c56d0.tar.gz | |
wlan: Increase size of MAX_WPA_RSN_IE_LEN in wlan_hdd_cfg80211_set_ie
In function wlan_hdd_cfg80211_set_ie, RSN IE is parsed and copied
into the buffer pWextState->WPARSNIE for length eLen + 2.
However, the buffer WPARSNIE is allocated only for MAX_WPA_RSN_IE_LEN
size. If eLen + 2 is greater than MAX_WPA_RSN_IE_LEN, a buffer overflow
would occur.
Increase the size of MAX_WPA_RSN_IE_LEN to 255 as per the spec
Change-Id: Ibf44e8dc1010e6e32b2262357d3aa180926d5c99
CRs-Fixed: 2299183
| -rw-r--r-- | CORE/HDD/inc/wlan_hdd_wext.h | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/CORE/HDD/inc/wlan_hdd_wext.h b/CORE/HDD/inc/wlan_hdd_wext.h index ec1205712..9e577bfbc 100644 --- a/CORE/HDD/inc/wlan_hdd_wext.h +++ b/CORE/HDD/inc/wlan_hdd_wext.h @@ -176,7 +176,7 @@ typedef enum #define IE_VENDOR_OUI_SIZE 4 /** Maximum Length of WPA/RSN IE */ -#define MAX_WPA_RSN_IE_LEN 40 +#define MAX_WPA_RSN_IE_LEN 255 /** Maximum Number of WEP KEYS */ #define MAX_WEP_KEYS 4 |