From 011904f038362be7fbc78984b2dce76c17516f4b Mon Sep 17 00:00:00 2001 From: Yeshwanth Sriram Guntuka Date: Fri, 20 Apr 2018 14:36:30 +0530 Subject: [PATCH] qcacld-3.0: Possible buffer overflow in wma_nan_rsp_event_handler Check for nan rsp data len does not take TLV header size into account which could lead to buffer overflow when copying data where TLV header size is taken into account. Fix is to subtract TLV header size and wmi_nan_event_hdr size from max allowed size when validating nan rsp data length. Change-Id: I341779a33ed218fdda5d008e949ced0c8cf05590 CRs-Fixed: 2227248 --- core/wma/src/wma_features.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/core/wma/src/wma_features.c b/core/wma/src/wma_features.c index 881da74e4afa..6c81b8e8e2d6 100644 --- a/core/wma/src/wma_features.c +++ b/core/wma/src/wma_features.c @@ -1259,7 +1259,7 @@ int wma_nan_rsp_event_handler(void *handle, uint8_t *event_buf, alloc_len = sizeof(tSirNanEvent); alloc_len += nan_rsp_event_hdr->data_len; if (nan_rsp_event_hdr->data_len > ((WMI_SVC_MSG_MAX_SIZE - - sizeof(*nan_rsp_event_hdr)) / sizeof(uint8_t)) || + WMI_TLV_HDR_SIZE - sizeof(*nan_rsp_event_hdr)) / sizeof(uint8_t)) || nan_rsp_event_hdr->data_len > param_buf->num_data) { WMA_LOGE("excess data length:%d, num_data:%d", nan_rsp_event_hdr->data_len, param_buf->num_data);