A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-13 00:00:00 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Corrections in buffer length checks in set_fils_config

Browse source 
In wlan_hdd_cfg80211_set_fils_config, incoming fils configs
are copied into local buffers. Buffer allocations happen with
internal length definitions, while lengths are checked against
definitions from WMI API's. This may cause a buffer overwrite
for fils erp realm buffer.

Use the same definitions for length checks that are used for
allocations.

Change-Id: Ie26bb1fdec9b12b429cb74dd290c155deb6c32f8
CRs-Fixed: 2137834
This commit is contained in:
Nachiket Kukade 2017-11-14 16:49:11 +05:30 • committed by snandini
commit 1be92caa6c
1 changed files with 3 additions and 3 deletions
Download patch file Download diff file Expand all files Collapse all files

6
core/hdd/src/wlan_hdd_cfg80211.c
View file

@ -16208,9 +16208,9 @@ static int wlan_hdd_cfg80211_set_fils_config(struct hdd_adapter *adapter,
req->fils_erp_next_seq_num, req->auth_type,
req->fils_erp_username_len, req->fils_erp_rrk_len,
req->fils_erp_realm_len);
if (req->fils_erp_rrk_len > WMI_FILS_MAX_RRK_LENGTH ||
req->fils_erp_realm_len > WMI_FILS_MAX_REALM_LENGTH ||
req->fils_erp_username_len > WMI_FILS_MAX_USERNAME_LENGTH) {
if (req->fils_erp_rrk_len > FILS_MAX_RRK_LENGTH ||
req->fils_erp_realm_len > FILS_MAX_REALM_LEN ||
req->fils_erp_username_len > FILS_MAX_KEYNAME_NAI_LENGTH) {
hdd_err("FILS info length limit exceeded");
goto fils_conn_fail;
}