From 0b1da04c883406f01a20933cdbf7330d342bb58f Mon Sep 17 00:00:00 2001 From: Abhinav Kumar Date: Mon, 17 Sep 2018 18:07:27 +0530 Subject: [PATCH] qcacld-3.0: Fix possible OOB read in proc_dnld_rsp In proc_dnld_rsp, pHdr->sBufSize is coming from fw message which could not be trusted. Before its use it should proc_dnld_rsp should verify it against its max allowed size (UINT_MAX). Fix is to add a sanity check for pHdr->sBufSize against UINT_MAX before its use. Change-Id: I6ec970483af860d5e42d6adac640274743f44f1a CRs-Fixed: 2308333 --- core/mac/src/cfg/cfg_proc_msg.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/core/mac/src/cfg/cfg_proc_msg.c b/core/mac/src/cfg/cfg_proc_msg.c index 9c637e1a0d04..607e6204ecdd 100644 --- a/core/mac/src/cfg/cfg_proc_msg.c +++ b/core/mac/src/cfg/cfg_proc_msg.c @@ -996,6 +996,13 @@ static void proc_dnld_rsp(tpAniSirGlobal pMac, uint16_t length, uint32_t *pParam pHdr->controlSize, pHdr->iBufSize, pHdr->sBufSize, pMac->cfg.gCfgMaxSBufSize); + if (pHdr->sBufSize > (UINT_MAX - + (((CFG_PARAM_MAX_NUM + 3 * pMac->cfg.gCfgMaxIBufSize) << 2) + + sizeof(tCfgBinHdr)))) { + pe_warn("Invalid sBufSize coming from fw: %d", pHdr->sBufSize); + retVal = WNI_CFG_INVALID_LEN; + goto end; + } expLen = ((CFG_PARAM_MAX_NUM + 3 * pMac->cfg.gCfgMaxIBufSize) << 2) + pHdr->sBufSize + sizeof(tCfgBinHdr);