commit dc5da6ac19accd8d31dc8977a48d01422b3862f5
author Jouni Malinen <jouni@qca.qualcomm.com> Thu Apr 09 22:49:02 2015 +0000
committer Android Git Automerger <android-git-automerger@android.com> Thu Apr 09 22:49:02 2015 +0000
tree 2cda3a38ac6b83fbe01160ed47eb02522c544eaa
parent 658fb4adb9458c3055c64a43833f1a9e89b4db74
parent b73408d1cfdbad09b1d470e8896e2abf7077d702

am b73408d1: am fdb708a3: P2P: Validate SSID element length before copying it

* commit 'b73408d1cfdbad09b1d470e8896e2abf7077d702':
  P2P: Validate SSID element length before copying it

src/p2p/p2p.c

diff --git a/src/p2p/p2p.c b/src/p2p/p2p.c
index 3a5486b..667b96b 100644
--- a/src/p2p/p2p.c
+++ b/src/p2p/p2p.c
@@ -735,6 +735,7 @@
 	if (os_memcmp(addr, p2p_dev_addr, ETH_ALEN) != 0)
 		os_memcpy(dev->interface_addr, addr, ETH_ALEN);
 	if (msg.ssid &&
+	    msg.ssid[1] <= sizeof(dev->oper_ssid) &&
 	    (msg.ssid[1] != P2P_WILDCARD_SSID_LEN ||
 	     os_memcmp(msg.ssid + 2, P2P_WILDCARD_SSID, P2P_WILDCARD_SSID_LEN)
 	     != 0)) {