diff options
| author |   Dan Carpenter <dan.carpenter@linaro.org> | 2025-08-29 15:48:45 +0300 |
|---|---|---|
| committer |   Johannes Berg <johannes.berg@intel.com> | 2025-09-03 09:37:55 +0200 |
| commit | 62b635dcd69c4fde7ce1de4992d71420a37e51e3 (patch) | |
| tree | b3fbf652e70d3dafff45425c670c1703e0f76229 | |
| parent | wifi: libertas: cap SSID len in lbs_associate() (diff) | |
| download | wireguard-linux-62b635dcd69c4fde7ce1de4992d71420a37e51e3.tar.xz wireguard-linux-62b635dcd69c4fde7ce1de4992d71420a37e51e3.zip | |
wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result()
If the ssid->datalen is more than IEEE80211_MAX_SSID_LEN (32) it would
lead to memory corruption so add some bounds checking.
Fixes: c38c70185101 ("wifi: cfg80211: Set SSID if it is not already set")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://patch.msgid.link/0aaaae4a3ed37c6252363c34ae4904b1604e8e32.1756456951.git.dan.carpenter@linaro.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>
| -rw-r--r-- | net/wireless/sme.c | 5 |
1 files changed, 4 insertions, 1 deletions
diff --git a/net/wireless/sme.c b/net/wireless/sme.c index 826ec0a6355f..3a028ff287fb 100644 --- a/net/wireless/sme.c +++ b/net/wireless/sme.c @@ -900,13 +900,16 @@ void __cfg80211_connect_result(struct net_device *dev, if (!wdev->u.client.ssid_len) { rcu_read_lock(); for_each_valid_link(cr, link) { + u32 ssid_len; + ssid = ieee80211_bss_get_elem(cr->links[link].bss, WLAN_EID_SSID); if (!ssid || !ssid->datalen) continue; - memcpy(wdev->u.client.ssid, ssid->data, ssid->datalen); + ssid_len = min(ssid->datalen, IEEE80211_MAX_SSID_LEN); + memcpy(wdev->u.client.ssid, ssid->data, ssid_len); wdev->u.client.ssid_len = ssid->datalen; break; } |