commit 5a434343e3515e2c1e29b879ed67898206016f3f
author Insun Song <insun.song@broadcom.com> Tue Jan 31 20:44:48 2017 -0800
committer Ecco Park <eccopark@google.com> Wed Feb 08 21:32:35 2017 +0000
tree c99c01b6848a8f4c5b690be9f0d9de185b0739f6
parent 38cfc377c2f0acd6e46c2a9b864fd500a1e8e544

net: wireless: bcmdhd: fix buffer overrun in ePNOCommand

added boundary check not to override allocated buffer.

Change-Id: Ia52e29adf282cace8f3a66e1a9e80eb375aa1629
Signed-off-by: Insun Song <insun.song@broadcom.com>
Bug: 32475556

bcmdhd/wifi_hal/gscan.cpp

diff --git a/bcmdhd/wifi_hal/gscan.cpp b/bcmdhd/wifi_hal/gscan.cpp
index 620fbe4..cd61d5a 100644
--- a/bcmdhd/wifi_hal/gscan.cpp
+++ b/bcmdhd/wifi_hal/gscan.cpp
@@ -1174,6 +1174,10 @@
         }
     }
     int createSetupRequest(WifiRequest& request) {
+        if (epno_params.num_networks > MAX_EPNO_NETWORKS) {
+            ALOGE("wrong epno num_networks:%d", epno_params.num_networks);
+            return WIFI_ERROR_INVALID_ARGS;
+        }
         int result = request.create(GOOGLE_OUI, GSCAN_SUBCMD_SET_EPNO_SSID);
         if (result < 0) {
             return result;