A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-13 16:16:15 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Validate TLV length in FILS wrapped data before processing

Browse source 
While processing FILS EAP TLVs present in FILS wrapped data in Auth Frame,
the tlv->length from the frame is used as the length to copy the buffer
into the FILS auth info without validating if the received buffer
length is at least greater than the length value in the TLV buffer.
This would lead to OOB read if the TLV length present in the frame is
greater than the actual data_len of the FILS wrapped data.

Add sanity check to return error if tlv->length is greater than wrapped
data_len + 2 with 2 bytes for the TLV header.

Change-Id: Ibe1183c8e318ceb75db6278c935786322a029d5c
CRs-Fixed: 2245944
This commit is contained in:
Vignesh Viswanathan 2018-05-29 10:25:56 +05:30 • committed by nshrivas
commit 228645aa79
1 changed files with 7 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
core/mac/src/pe/lim/lim_process_fils.c
View file

@ -345,6 +345,13 @@ static uint32_t lim_process_fils_eap_tlv(tpPESession pe_session,
pe_debug("tlv type %x len %u total %u",
tlv->type, tlv->length, data_len);
if (tlv->length > (data_len - 2)) {
pe_err("tlv len %d greater data_len %d",
tlv->length, data_len);
return 0;
}
switch (tlv->type) {
case SIR_FILS_EAP_TLV_KEYNAME_NAI:
auth_info->keyname = qdf_mem_malloc(tlv->length);