A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-24 13:44:26 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix buf overflow in __wlan_hdd_cfg80211_update_connect_params

Browse source 
Currently, number of bytes being copied into keyname_nai buffer is
key_nai_length, which can be greater than FILS_MAX_KEYNAME_NAI_LENGTH.
But the size of keyname_nai is limited to FILS_MAX_KEYNAME_NAI_LENGTH,
which may cause buffer overflow.

To address this issue, add check for key_nai_length against
FILS_MAX_KEYNAME_NAI_LENGTH to ensure buffer overflow does not happen.

Change-Id: I88c89b1fef6fdb1c4bd93e0fb8f3e54634b4940f
CRs-Fixed: 2208881
This commit is contained in:
Dundi Raviteja 2018-03-23 15:49:54 +05:30 • committed by nshrivas
commit 170d287f1d
1 changed files with 6 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
core/hdd/src/wlan_hdd_cfg80211.c
View file

@ -22170,6 +22170,12 @@ static int __wlan_hdd_cfg80211_update_connect_params(
fils_info->key_nai_length = req->fils_erp_username_len +
sizeof(char) +
req->fils_erp_realm_len;
if (fils_info->key_nai_length >
FILS_MAX_KEYNAME_NAI_LENGTH) {
hdd_err("Key NAI Length %d",
fils_info->key_nai_length);
return -EINVAL;
}
if (req->fils_erp_username_len && req->fils_erp_username) {
buf = fils_info->keyname_nai;
qdf_mem_copy(buf, req->fils_erp_username,