diff options
| author | Etan Cohen <etancohen@google.com> | 2019-11-25 11:41:58 -0800 |
|---|---|---|
| committer | Etan Cohen <etancohen@google.com> | 2019-11-26 12:35:49 -0800 |
| commit | 1cefaf6241bf9a73ec3ed148104fc7dd7c30c7fc (patch) | |
| tree | 5f4fdca0fbac0fec05746c6a52dc92a770cc588d /wifi/1.4/default/hidl_struct_util.cpp | |
| parent | ad1222486d27b7029a2c7a46bcd20b8abfa378b4 (diff) | |
[AWARE] Protect string copy against buffer overflow
Fixes: 143789898
Test: (Unit) atest com.android.server.wifi
Test: ACTS ThroughputTest:test_iperf_single_ndp_aware_only_ib
Test: (VTS) atest VtsHalWifiApV1_4TargetTest
Change-Id: I5b8aa1d9a6388fe20cb7e1cd6a76d5e59e14d099
Diffstat (limited to 'wifi/1.4/default/hidl_struct_util.cpp')
| -rw-r--r-- | wifi/1.4/default/hidl_struct_util.cpp | 16 |
1 files changed, 14 insertions, 2 deletions
diff --git a/wifi/1.4/default/hidl_struct_util.cpp b/wifi/1.4/default/hidl_struct_util.cpp index 13a09f3438..6eeb6422e5 100644 --- a/wifi/1.4/default/hidl_struct_util.cpp +++ b/wifi/1.4/default/hidl_struct_util.cpp @@ -1822,7 +1822,13 @@ bool convertHidlNanDataPathInitiatorRequestToLegacy( convertHidlNanDataPathChannelCfgToLegacy( hidl_request.channelRequestType); legacy_request->channel = hidl_request.channel; - strcpy(legacy_request->ndp_iface, hidl_request.ifaceName.c_str()); + if (strnlen(hidl_request.ifaceName.c_str(), IFNAMSIZ + 1) == IFNAMSIZ + 1) { + LOG(ERROR) << "convertHidlNanDataPathInitiatorRequestToLegacy: " + "ifaceName too long"; + return false; + } + strncpy(legacy_request->ndp_iface, hidl_request.ifaceName.c_str(), + IFNAMSIZ + 1); legacy_request->ndp_cfg.security_cfg = (hidl_request.securityConfig.securityType != NanDataPathSecurityType::OPEN) @@ -1903,7 +1909,13 @@ bool convertHidlNanDataPathIndicationResponseToLegacy( ? legacy_hal::NAN_DP_REQUEST_ACCEPT : legacy_hal::NAN_DP_REQUEST_REJECT; legacy_request->ndp_instance_id = hidl_request.ndpInstanceId; - strcpy(legacy_request->ndp_iface, hidl_request.ifaceName.c_str()); + if (strnlen(hidl_request.ifaceName.c_str(), IFNAMSIZ + 1) == IFNAMSIZ + 1) { + LOG(ERROR) << "convertHidlNanDataPathIndicationResponseToLegacy: " + "ifaceName too long"; + return false; + } + strncpy(legacy_request->ndp_iface, hidl_request.ifaceName.c_str(), + IFNAMSIZ + 1); legacy_request->ndp_cfg.security_cfg = (hidl_request.securityConfig.securityType != NanDataPathSecurityType::OPEN) |