wifi: cfg80211: sme: cap SSID length in __cfg80211_connect_result()

If the ssid->datalen is more than IEEE80211_MAX_SSID_LEN (32) it would
lead to memory corruption so add some bounds checking.

Fixes: c38c70185101 ("wifi: cfg80211: Set SSID if it is not already set")
Signed-off-by: Dan Carpenter <dan.carpenter@linaro.org>
Link: https://patch.msgid.link/0aaaae4a3ed37c6252363c34ae4904b1604e8e32.1756456951.git.dan.carpenter@linaro.org
Signed-off-by: Johannes Berg <johannes.berg@intel.com>

diff --git a/net/wireless/sme.c b/net/wireless/sme.c
index 826ec0a6355f1c724a23c3f5fdbc9597a0ff68c8..3a028ff287fbbe7a22312d0af14a6d5c4424ef0d 100644 (file)
--- a/net/wireless/sme.c
+++ b/net/wireless/sme.c
@@ -900,13 +900,16 @@ void __cfg80211_connect_result(struct net_device *dev,
        if (!wdev->u.client.ssid_len) {
                rcu_read_lock();
                for_each_valid_link(cr, link) {
+                       u32 ssid_len;
+
                        ssid = ieee80211_bss_get_elem(cr->links[link].bss,
                                                      WLAN_EID_SSID);
 
                        if (!ssid || !ssid->datalen)
                                continue;
 
-                       memcpy(wdev->u.client.ssid, ssid->data, ssid->datalen);
+                       ssid_len = min(ssid->datalen, IEEE80211_MAX_SSID_LEN);
+                       memcpy(wdev->u.client.ssid, ssid->data, ssid_len);
                        wdev->u.client.ssid_len = ssid->datalen;
                        break;
                }