From 089564f11df12e45ca876fa9618966ccf9f2350e Mon Sep 17 00:00:00 2001 From: Vignesh Viswanathan Date: Tue, 23 Jan 2018 14:54:18 +0530 Subject: [PATCH] qcacmn: Add sanity check for WMA NDP extract TLV functions In extract_ndp_confirm_tlv & extract_ndp_ind_tlv, ndp_cfg len & num_ndp_app_info is from fw. If they are greater than the actual length of buffer sent in FW, OOB access and info leak would occur. Add sanity checks for ndp_cfg_len and num_npd_app_info with the actual length of the buffer from TLV header in functions extract_ndp_confirm_tlv & extract_ndp_ind_tlv to prevent OOB access. Change-Id: I9ecf55a3606036d3e1f0916c948c4360475965fa CRs-Fixed: 2176968 --- wmi/src/wmi_unified_tlv.c | 27 +++++++++++++++++++++++++++ 1 file changed, 27 insertions(+) diff --git a/wmi/src/wmi_unified_tlv.c b/wmi/src/wmi_unified_tlv.c index 0b6196303994..7e8f19041e6f 100644 --- a/wmi/src/wmi_unified_tlv.c +++ b/wmi/src/wmi_unified_tlv.c @@ -17400,6 +17400,19 @@ static QDF_STATUS extract_ndp_ind_tlv(wmi_unified_t wmi_handle, fixed_params = (wmi_ndp_indication_event_fixed_param *)event->fixed_param; + if (fixed_params->ndp_cfg_len > event->num_ndp_cfg) { + WMI_LOGE("FW message ndp cfg length %d larger than TLV hdr %d", + fixed_params->ndp_cfg_len, event->num_ndp_cfg); + return QDF_STATUS_E_INVAL; + } + + if (fixed_params->ndp_app_info_len > event->num_ndp_app_info) { + WMI_LOGE("FW message ndp app info length %d more than TLV hdr %d", + fixed_params->ndp_app_info_len, + event->num_ndp_app_info); + return QDF_STATUS_E_INVAL; + } + *rsp = qdf_mem_malloc(sizeof(**rsp)); if (!(*rsp)) { WMI_LOGE("malloc failed"); @@ -17474,10 +17487,24 @@ static QDF_STATUS extract_ndp_confirm_tlv(wmi_unified_t wmi_handle, fixed_params->ndp_instance_id, fixed_params->rsp_code, fixed_params->reason_code, fixed_params->num_active_ndps_on_peer); + + if (fixed_params->ndp_cfg_len > event->num_ndp_cfg) { + WMI_LOGE("FW message ndp cfg length %d larger than TLV hdr %d", + fixed_params->ndp_cfg_len, event->num_ndp_cfg); + return QDF_STATUS_E_INVAL; + } + WMI_LOGD("ndp_cfg - %d bytes", fixed_params->ndp_cfg_len); QDF_TRACE_HEX_DUMP(QDF_MODULE_ID_WMA, QDF_TRACE_LEVEL_DEBUG, &event->ndp_cfg, fixed_params->ndp_cfg_len); + if (fixed_params->ndp_app_info_len > event->num_ndp_app_info) { + WMI_LOGE("FW message ndp app info length %d more than TLV hdr %d", + fixed_params->ndp_app_info_len, + event->num_ndp_app_info); + return QDF_STATUS_E_INVAL; + } + WMI_LOGD("ndp_app_info - %d bytes", fixed_params->ndp_app_info_len); QDF_TRACE_HEX_DUMP(QDF_MODULE_ID_WMA, QDF_TRACE_LEVEL_DEBUG,