Home Home > GIT Browse > stable
summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorTakashi Iwai <tiwai@suse.de>2019-04-17 12:22:56 +0200
committerTakashi Iwai <tiwai@suse.de>2019-04-17 12:22:58 +0200
commit5b1614f9664dc3a33fa3bc92f9de2814018163ea (patch)
tree2ccae63be8f7c6bc2cf92dca2b146883d4093cfb
parent629b8f8306cc8dbd156d9f81a6cf247c289e59b6 (diff)
brcmfmac: assure SSID length from firmware is limitedstable
(CVE-2019-9500,bsc#1132681). suse-commit: 4835ec05cd8c529daf829c32d39f5954c558e813
-rw-r--r--drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c2
1 files changed, 2 insertions, 0 deletions
diff --git a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
index 35301237d435..9f85eec3d79f 100644
--- a/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
+++ b/drivers/net/wireless/broadcom/brcm80211/brcmfmac/cfg80211.c
@@ -3474,6 +3474,8 @@ brcmf_wowl_nd_results(struct brcmf_if *ifp, const struct brcmf_event_msg *e,
}
netinfo = brcmf_get_netinfo_array(pfn_result);
+ if (netinfo->SSID_len > IEEE80211_MAX_SSID_LEN)
+ netinfo->SSID_len = IEEE80211_MAX_SSID_LEN;
memcpy(cfg->wowl.nd->ssid.ssid, netinfo->SSID, netinfo->SSID_len);
cfg->wowl.nd->ssid.ssid_len = netinfo->SSID_len;
cfg->wowl.nd->n_channels = 1;