Commit 62b635dc authored by Dan Carpenter's avatar Dan Carpenter Committed by Johannes Berg
Browse files

wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result() 



If the ssid->datalen is more than IEEE80211_MAX_SSID_LEN (32) it would
lead to memory corruption so add some bounds checking.

Fixes: c38c7018 ("wifi: cfg80211: Set SSID if it is not already set")
Signed-off-by: default avatarDan Carpenter <dan.carpenter@linaro.org>
Link: https://patch.msgid.link/0aaaae4a3ed37c6252363c34ae4904b1604e8e32.1756456951.git.dan.carpenter@linaro.org


Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
parent c786794b

net/wireless/sme.c

+4 −1
Original line number Diff line number Diff line
@@ -900,13 +900,16 @@ void __cfg80211_connect_result(struct net_device *dev, 
	if (!wdev->u.client.ssid_len) {

		rcu_read_lock();

		for_each_valid_link(cr, link) {

			u32 ssid_len;



			ssid = ieee80211_bss_get_elem(cr->links[link].bss,

						      WLAN_EID_SSID);



			if (!ssid || !ssid->datalen)

				continue;



			memcpy(wdev->u.client.ssid, ssid->data, ssid->datalen);

			ssid_len = min(ssid->datalen, IEEE80211_MAX_SSID_LEN);

			memcpy(wdev->u.client.ssid, ssid->data, ssid_len);

			wdev->u.client.ssid_len = ssid->datalen;

			break;

		}