Piteball
/
android_kernel_samsung_msm8976
mirror of https://github.com/team-infusion-developers/android_kernel_samsung_msm8976.git
1
1
Fork 0
Code Issues Projects Releases Wiki Activity

qcacld-2.0: Validate assoc response IE len before copy 

Propagate from qcacld3.0 to qcacld2.0

When host sends assoc response to supplicant, it
allocates a buffer of fixed size and copies a variable
length of assoc response IEs to this fixed sized buffer.
There is a possibility of OOB write to the allocated buffer
if the assoc response IEs length is greater than the
allocated buffer size.

To avoid above issue validate the assoc response IEs length
with the allocated buffer size before data copy to the buffer.

Change-ID: Ib12385e9ff04e5172ae8b505faf959e426fda439
CRs-Fixed: 2616229
This commit is contained in:
Jingxiang Ge 2020-02-24 13:17:51 +08:00 committed by syphyr
parent d56d48002c
commit ecc036137e
1 changed files with 8 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
drivers/net/wireless/qcacld-2.0/CORE/HDD/src/wlan_hdd_assoc.c
View File

@ -1,5 +1,5 @@
/*
* Copyright (c) 2012-2016 The Linux Foundation. All rights reserved.
* Copyright (c) 2012-2016, 2020 The Linux Foundation. All rights reserved.
*
* Previously licensed under the ISC license by Qualcomm Atheros, Inc.
*
@ -1364,8 +1364,9 @@ static void hdd_SendReAssocEvent(struct net_device *dev,
goto done;
}
if (pCsrRoamInfo->nAssocRspLength == 0) {
hddLog(LOGE, FL("Invalid assoc response length"));
if (pCsrRoamInfo->nAssocRspLength < FT_ASSOC_RSP_IES_OFFSET) {
hddLog(LOGE, FL("Invalid assoc response length %d"),
pCsrRoamInfo->nAssocRspLength);
goto done;
}
@ -1390,6 +1391,10 @@ static void hdd_SendReAssocEvent(struct net_device *dev,
/* Send the Assoc Resp, the supplicant needs this for initial Auth */
len = pCsrRoamInfo->nAssocRspLength - FT_ASSOC_RSP_IES_OFFSET;
if (len > IW_GENERIC_IE_MAX) {
hddLog(LOGE, FL("Invalid Assoc resp length %d"), len);
goto done;
}
rspRsnLength = len;
memcpy(rspRsnIe, pFTAssocRsp, len);
memset(rspRsnIe + len, 0, IW_GENERIC_IE_MAX - len);