commit e3b033a418d316f98153b6c0ac24ec94fa583cdd
author Insun Song <insun.song@broadcom.com> Fri Apr 21 14:45:12 2017 -0700
committer android-build-team Robot <android-build-team-robot@google.com> Thu May 25 17:43:46 2017 +0000
tree b3ae85bbd9553c83ef4b73b53affb8b54e47964c
parent a81c7efc3c39c38bda34c26924da552bbd279bf0

net: wireless: bcmdhd: adding bssid count NL attribute in SWC config

adding new NL attribute item which contain SWC BSSIDs count. This help for
kernel driver to know it early before parsing whole NL buffer. and sort
out security vulnerability cases where malicious buffer injected.

Signed-off-by: Insun Song <insun.song@broadcom.com>
Bug: 34973477
Change-Id: I1db053e722876e4b97d8f25fdc881279fa467bf6
(cherry picked from commit f57fbe161190c2910c349b2b3af0b9b27c6a1c91)

bcmdhd/wifi_hal/gscan.cpp

diff --git a/bcmdhd/wifi_hal/gscan.cpp b/bcmdhd/wifi_hal/gscan.cpp
index 620fbe4..808ab69 100644
--- a/bcmdhd/wifi_hal/gscan.cpp
+++ b/bcmdhd/wifi_hal/gscan.cpp
@@ -1426,30 +1426,38 @@
         if (result < 0) {
             return result;
         }
-
-        struct nlattr * attr = request.attr_start(GSCAN_ATTRIBUTE_SIGNIFICANT_CHANGE_BSSIDS);
-
-        for (int i = 0; i < mParams.num_bssid; i++) {
-            nlattr *attr2 = request.attr_start(i);
-            if (attr2 == NULL) {
+        result = request.put_u16(GSCAN_ATTRIBUTE_NUM_BSSID, mParams.num_bssid);
+        if (result < 0) {
+            return result;
+        }
+        if (mParams.num_bssid != 0) {
+            nlattr* attr = request.attr_start(GSCAN_ATTRIBUTE_SIGNIFICANT_CHANGE_BSSIDS);
+            if (attr == NULL) {
                 return WIFI_ERROR_OUT_OF_MEMORY;
             }
-            result = request.put_addr(GSCAN_ATTRIBUTE_BSSID, mParams.ap[i].bssid);
-            if (result < 0) {
-                return result;
-            }
-            result = request.put_u8(GSCAN_ATTRIBUTE_RSSI_HIGH, mParams.ap[i].high);
-            if (result < 0) {
-                return result;
-            }
-            result = request.put_u8(GSCAN_ATTRIBUTE_RSSI_LOW, mParams.ap[i].low);
-            if (result < 0) {
-                return result;
-            }
-            request.attr_end(attr2);
-        }
 
-        request.attr_end(attr);
+            for (int i = 0; i < mParams.num_bssid; i++) {
+                nlattr* attr2 = request.attr_start(i);
+                if (attr2 == NULL) {
+                    return WIFI_ERROR_OUT_OF_MEMORY;
+                }
+                result = request.put_addr(GSCAN_ATTRIBUTE_BSSID, mParams.ap[i].bssid);
+                if (result < 0) {
+                    return result;
+                }
+                result = request.put_u8(GSCAN_ATTRIBUTE_RSSI_HIGH, mParams.ap[i].high);
+                if (result < 0) {
+                    return result;
+                }
+                result = request.put_u8(GSCAN_ATTRIBUTE_RSSI_LOW, mParams.ap[i].low);
+                if (result < 0) {
+                    return result;
+                }
+                request.attr_end(attr2);
+            }
+
+            request.attr_end(attr);
+        }
         request.attr_end(data);
 
         return result;