commit 56509450883285e6384f7e51d97a726456d367a2
author Jouni Malinen <jouni@qca.qualcomm.com> Fri Apr 10 09:45:41 2015 +0000
committer Android Git Automerger <android-git-automerger@android.com> Fri Apr 10 09:45:41 2015 +0000
tree 31cc01636db65fff7efe107063ea547a5de43f78
parent 0a217de1802bc5cf785524c1913af7ae3faa9c54
parent dc5da6ac19accd8d31dc8977a48d01422b3862f5

am dc5da6ac: am b73408d1: am fdb708a3: P2P: Validate SSID element length before copying it

* commit 'dc5da6ac19accd8d31dc8977a48d01422b3862f5':
  P2P: Validate SSID element length before copying it

src/p2p/p2p.c

diff --git a/src/p2p/p2p.c b/src/p2p/p2p.c
index 7d4a03c..28c3aa0 100644
--- a/src/p2p/p2p.c
+++ b/src/p2p/p2p.c
@@ -736,6 +736,7 @@
 	if (os_memcmp(addr, p2p_dev_addr, ETH_ALEN) != 0)
 		os_memcpy(dev->interface_addr, addr, ETH_ALEN);
 	if (msg.ssid &&
+	    msg.ssid[1] <= sizeof(dev->oper_ssid) &&
 	    (msg.ssid[1] != P2P_WILDCARD_SSID_LEN ||
 	     os_memcmp(msg.ssid + 2, P2P_WILDCARD_SSID, P2P_WILDCARD_SSID_LEN)
 	     != 0)) {