Skip to content

Commit 0ff4e43

Browse files
authored
RDKB-61233: Easymesh Agent Crash Fix (#592)
Reason for change: Added length check to prevent buffer overflow if frame data length is higher. Test Procedure: Ensure no crash issues when client connects to network Risks: Medium Priority: P1 Signed-off-by: Rakhil P E <[email protected]>
1 parent 55fa50d commit 0ff4e43

File tree

1 file changed

+4
-1
lines changed

1 file changed

+4
-1
lines changed

source/webconfig/wifi_easymesh_translator.c

Lines changed: 4 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -640,7 +640,10 @@ webconfig_error_t translate_associated_clients_to_easymesh_sta_info(webconfig_su
640640
}
641641
mgmt = (struct ieee80211_mgmt *) assoc_dev_data->sta_data.msg_data.data;
642642
tag_len = assoc_dev_data->sta_data.msg_data.frame.len - IEEE80211_HDRLEN - sizeof(mgmt->u.assoc_req);
643-
memcpy(em_sta_dev_info->frame_body, mgmt->u.assoc_req.variable, sizeof(em_sta_dev_info->frame_body));
643+
if (tag_len > EM_MAX_FRAME_BODY_LEN) {
644+
tag_len = EM_MAX_FRAME_BODY_LEN-1;
645+
}
646+
memcpy(em_sta_dev_info->frame_body, mgmt->u.assoc_req.variable, tag_len);
644647
em_sta_dev_info->frame_body_len = tag_len;
645648

646649
if (assoc_dev_data->client_state == 0) {

0 commit comments

Comments
 (0)