Commit 889cb360 authored by Eliad Peller's avatar Eliad Peller Committed by Luciano Coelho

wl12xx: simplify wl1271_ssid_set()

Simplify wl1271_ssid_set by re-using cfg80211_find_ie instead of
reimplementing it.

Additionally, add a length check to prevent a potential buffer overflow.
Signed-off-by: default avatarEliad Peller <eliad@wizery.com>
Signed-off-by: default avatarLuciano Coelho <coelho@ti.com>
parent 6b86bd62
......@@ -2376,20 +2376,24 @@ static int wl1271_op_set_rts_threshold(struct ieee80211_hw *hw, u32 value)
static int wl1271_ssid_set(struct wl1271 *wl, struct sk_buff *skb,
int offset)
{
u8 *ptr = skb->data + offset;
u8 ssid_len;
const u8 *ptr = cfg80211_find_ie(WLAN_EID_SSID, skb->data + offset,
skb->len - offset);
/* find the location of the ssid in the beacon */
while (ptr < skb->data + skb->len) {
if (ptr[0] == WLAN_EID_SSID) {
wl->ssid_len = ptr[1];
memcpy(wl->ssid, ptr+2, wl->ssid_len);
return 0;
if (!ptr) {
wl1271_error("No SSID in IEs!");
return -ENOENT;
}
ptr += (ptr[1] + 2);
ssid_len = ptr[1];
if (ssid_len > IEEE80211_MAX_SSID_LEN) {
wl1271_error("SSID is too long!");
return -EINVAL;
}
wl1271_error("No SSID in IEs!\n");
return -ENOENT;
wl->ssid_len = ssid_len;
memcpy(wl->ssid, ptr+2, ssid_len);
return 0;
}
static int wl1271_bss_erp_info_changed(struct wl1271 *wl,
......
Markdown is supported
0%
or
You are about to add 0 people to the discussion. Proceed with caution.
Finish editing this message first!
Please register or to comment