Limit scan frequency list to 100 entries

There is no real use case for the scan to be requested on more than 100
channels individually. To avoid excessively long lists with invalid
configuration, use 100 entry limit for the list before dropping to the
fallback scan-all-channels option.

Signed-off-by: Jouni Malinen <j@w1.fi>

diff --git a/wpa_supplicant/scan.c b/wpa_supplicant/scan.c
index ad9d77af8c0322091f8a0beaf1ec3d2b96cc23b4..b47573094126a52fee145bf47b352dbe20912ab8 100644 (file)
--- a/wpa_supplicant/scan.c
+++ b/wpa_supplicant/scan.c
@@ -1109,7 +1109,9 @@ static void wpa_supplicant_scan(void *eloop_ctx, void *timeout_ctx)
                     tssid = tssid->next) {
                        if (wpas_network_disabled(wpa_s, tssid))
                                continue;
-                       if ((params.freqs || !freqs_set) && tssid->scan_freq) {
+                       if (((params.freqs || !freqs_set) &&
+                            tssid->scan_freq) &&
+                           int_array_len(params.freqs) < 100) {
                                int_array_concat(&params.freqs,
                                                 tssid->scan_freq);
                        } else {