From 24e5b21555b5efb72210cfe21423d45dcc4dcd53 Mon Sep 17 00:00:00 2001 From: gaurank kathpalia Date: Thu, 10 May 2018 15:46:53 +0530 Subject: [PATCH] qcacld-3.0: Remove off-by-one write condition in sch_beacon_process In the API, the driver inserts 0 after the SSID name, to mark the end of the ssid, but if the SSID name is 32 characters which is the max SSID length possible, the driver puts 0 at the 33rd place of memory which is not the part of the SSID name, which results in OOB write, or off-by-one write condition. Fix is to remove the addition of 0 after ssid, as in every case the driver prints the ssid, taking the ssid length as the input, and in that case insertion of 0 will not serve any purpose. Change-Id: I1d58026ec9f48fe9d00bd2f50783c65899588978 CRs-Fixed: 2232526 --- core/mac/inc/sir_mac_prot_def.h | 3 ++- core/mac/src/pe/sch/sch_beacon_process.c | 3 --- 2 files changed, 2 insertions(+), 4 deletions(-) diff --git a/core/mac/inc/sir_mac_prot_def.h b/core/mac/inc/sir_mac_prot_def.h index 5c5d9703c1a9..90251e03af75 100644 --- a/core/mac/inc/sir_mac_prot_def.h +++ b/core/mac/inc/sir_mac_prot_def.h @@ -1015,9 +1015,10 @@ struct merged_mac_rate_set { uint8_t rate[2 * SIR_MAC_RATESET_EID_MAX]; }; +/* Reserve 1 byte for NULL character in the SSID name field to print in %s */ typedef struct sSirMacSSid { uint8_t length; - uint8_t ssId[SIR_MAC_MAX_SSID_LENGTH]; + uint8_t ssId[SIR_MAC_MAX_SSID_LENGTH +1]; } qdf_packed tSirMacSSid; typedef struct sSirMacWpaInfo { diff --git a/core/mac/src/pe/sch/sch_beacon_process.c b/core/mac/src/pe/sch/sch_beacon_process.c index 8d6cff58dfb6..0e0f4955afe4 100644 --- a/core/mac/src/pe/sch/sch_beacon_process.c +++ b/core/mac/src/pe/sch/sch_beacon_process.c @@ -1074,9 +1074,6 @@ sch_beacon_process(tpAniSirGlobal mac_ctx, uint8_t *rx_pkt_info, return; } - if (bcn.ssidPresent) - bcn.ssId.ssId[bcn.ssId.length] = 0; - /* * Now process the beacon in the context of the BSS which is * transmitting the beacons, if one is found