A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-13 08:07:32 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix possible integer underflow in cfg80211_rx_mgmt

Browse source 
In the function cfg80211_rx_mgmt, data_len is calculated as
len - ieee80211_hdrlen(mgmt->frame_control). Len is not
validated before this calculation. So a possible integer
underflow will occur if len value is less than the value of
ieee80211_hdrlen(mgmt->frame_control).

Validate the value of len against
ieee80211_hdrlen(mgmt->frame_control) in the caller.

Change-Id: Iae776daf37b0c052bd4ce4da44ea728d121eae51
CRs-Fixed: 2263758
This commit is contained in:
Pragaspathi Thilagaraj 2018-07-18 15:19:36 +05:30 • committed by nshrivas
commit 28ffc04cc7
1 changed files with 7 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

7
core/hdd/src/wlan_hdd_main.c
View file

@ -8582,11 +8582,18 @@ void hdd_indicate_mgmt_frame(tSirSmeMgmtFrameInd *frame_ind)
struct hdd_context *hdd_ctx = NULL;
struct hdd_adapter *adapter = NULL;
int i;
struct ieee80211_mgmt *mgmt =
(struct ieee80211_mgmt *)frame_ind->frameBuf;
hdd_ctx = cds_get_context(QDF_MODULE_ID_HDD);
if (wlan_hdd_validate_context(hdd_ctx))
return;
if (frame_ind->frame_len < ieee80211_hdrlen(mgmt->frame_control)) {
hdd_err(" Invalid frame length");
return;
}
if (SME_SESSION_ID_ANY == frame_ind->sessionId) {
for (i = 0; i < CSR_ROAM_SESSION_MAX; i++) {
adapter =