A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-24 21:54:34 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: Fix buffer overflow while memcpy of pmk_ext

Browse source 
Due to commit : Ia630580bba050513800e3acac875baf937ec8d14
while processing RSO command driver fills the pmk_ext_len without
checking the pmk_len. If pmk_len is NULL then pmk_ext_len gets
filled with a negative value and after this while doing the
memcpy it will cause the buffer overflow due to invalid length.

Fix is to verify pmk_len before filling the value in pmk_ext_len.

Change-Id: I506d691ca5bd5d627fc85073346698126ad2ba56
CRs-Fixed: 2707959
This commit is contained in:
Srikanth Marepalli 2020-06-11 03:21:06 +05:30
commit 0497ce7057
1 changed files with 13 additions and 11 deletions
Download patch file Download diff file Expand all files Collapse all files

24
wmi/src/wmi_unified_roam_tlv.c
View file

@ -1066,6 +1066,8 @@ wmi_fill_sae_single_pmk_param(struct roam_offload_scan_params *params,
}
#endif
#define ROAM_OFFLOAD_PMK_EXT_BYTES 16
/**
* send_roam_scan_offload_mode_cmd_tlv() - send roam scan mode request to fw
* @wmi_handle: wmi handle
@ -1376,17 +1378,17 @@ send_roam_scan_offload_mode_cmd_tlv(wmi_unified_t wmi_handle,
roam_req->psk_pmk,
roam_offload_11i->pmk_len);
if (auth_mode ==
WMI_AUTH_RSNA_SUITE_B_8021X_SHA384) {
roam_offload_11i->pmk_ext_len =
(roam_req->pmk_len -
ROAM_OFFLOAD_PMK_BYTES);
qdf_mem_copy(roam_offload_11i->pmk_ext,
&roam_req->psk_pmk[
ROAM_OFFLOAD_PMK_BYTES],
roam_offload_11i->
pmk_ext_len);
}
roam_offload_11i->pmk_ext_len =
((roam_req->pmk_len >
ROAM_OFFLOAD_PMK_BYTES) &&
(auth_mode ==
WMI_AUTH_RSNA_SUITE_B_8021X_SHA384)) ?
ROAM_OFFLOAD_PMK_EXT_BYTES : 0;
qdf_mem_copy(roam_offload_11i->pmk_ext,
&roam_req->psk_pmk[
ROAM_OFFLOAD_PMK_BYTES],
roam_offload_11i->pmk_ext_len);
WMITLV_SET_HDR(&roam_offload_11i->tlv_header,
WMITLV_TAG_STRUC_wmi_roam_11i_offload_tlv_param,