Merge tag 'LA.VENDOR.13.2.0.r1-22400-KAILUA.QSSI14.0' into staging/lineage-21.0_merge-LA.VENDOR.13.2.0.r1-22400-KAILUA.QSSI14.0
LA.VENDOR.13.2.0.r1-22400-KAILUA.QSSI14.0
# By Hu Wang (1) and Madhvapathi Sriram (1)
# Via Linux Build Service Account (2) and others
* tag 'LA.VENDOR.13.2.0.r1-22400-KAILUA.QSSI14.0':
wpa_supplicant_lib: Allow -82dBm as non-SRG OBSS PD threshold
wpa_supplicant_lib: Fix integer overflow in result_copy_to_buf
Change-Id: I228fa8a93cbc2ab77e274169a42b7fbc81e21b02
diff --git a/qcwcn/wpa_supplicant_8_lib/driver_cmd_nl80211.c b/qcwcn/wpa_supplicant_8_lib/driver_cmd_nl80211.c
index daced34..a540884 100644
--- a/qcwcn/wpa_supplicant_8_lib/driver_cmd_nl80211.c
+++ b/qcwcn/wpa_supplicant_8_lib/driver_cmd_nl80211.c
@@ -3899,16 +3899,19 @@
char *result_copy_to_buf(char *src, char *dst_buf, int *dst_len)
{
- int str_len, remaining = 0;
+ size_t str_len, remaining = 0;
+
+ if (!dst_buf || *dst_len < 0)
+ return NULL;
remaining = *dst_len;
str_len = strlen(src);
- remaining = remaining - (str_len + 1);
- if (remaining <= 0) {
- wpa_printf(MSG_ERROR, "destination buffer length not enough");
+ if (remaining > 0 && (remaining - 1) > str_len)
+ remaining = remaining - (str_len + 1);
+ else
return NULL;
- }
+
os_memcpy(dst_buf, src, str_len);
*dst_len = remaining;
diff --git a/qcwcn/wpa_supplicant_8_lib/driver_cmd_nl80211_sr.c b/qcwcn/wpa_supplicant_8_lib/driver_cmd_nl80211_sr.c
index d0cb989..47e26e7 100644
--- a/qcwcn/wpa_supplicant_8_lib/driver_cmd_nl80211_sr.c
+++ b/qcwcn/wpa_supplicant_8_lib/driver_cmd_nl80211_sr.c
@@ -343,11 +343,7 @@
cmd += 21;
cmd = skip_white_space(cmd);
pd_thres = get_s32_from_string(cmd, &ret);
- /**
- * For non-SRG OBSS, allowed range for PD threshold
- * is -62 to -81 as -82 is fixed as min offset.
- **/
- if (ret < 0 || pd_thres <= OBSS_PD_THRESHOLD_MIN ||
+ if (ret < 0 || pd_thres < OBSS_PD_THRESHOLD_MIN ||
pd_thres > OBSS_PD_THRESHOLD_MAX) {
wpa_printf(MSG_ERROR, "Invalid Non-SRG PD threshold: %d", pd_thres);
return -EINVAL;