From 28ffc04cc7bd13027aff341393d0b085cbb5e063 Mon Sep 17 00:00:00 2001 From: Pragaspathi Thilagaraj Date: Wed, 18 Jul 2018 15:19:36 +0530 Subject: [PATCH] qcacld-3.0: Fix possible integer underflow in cfg80211_rx_mgmt In the function cfg80211_rx_mgmt, data_len is calculated as len - ieee80211_hdrlen(mgmt->frame_control). Len is not validated before this calculation. So a possible integer underflow will occur if len value is less than the value of ieee80211_hdrlen(mgmt->frame_control). Validate the value of len against ieee80211_hdrlen(mgmt->frame_control) in the caller. Change-Id: Iae776daf37b0c052bd4ce4da44ea728d121eae51 CRs-Fixed: 2263758 --- core/hdd/src/wlan_hdd_main.c | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/core/hdd/src/wlan_hdd_main.c b/core/hdd/src/wlan_hdd_main.c index aba535da18ca..d6d2687720b5 100644 --- a/core/hdd/src/wlan_hdd_main.c +++ b/core/hdd/src/wlan_hdd_main.c @@ -8582,11 +8582,18 @@ void hdd_indicate_mgmt_frame(tSirSmeMgmtFrameInd *frame_ind) struct hdd_context *hdd_ctx = NULL; struct hdd_adapter *adapter = NULL; int i; + struct ieee80211_mgmt *mgmt = + (struct ieee80211_mgmt *)frame_ind->frameBuf; hdd_ctx = cds_get_context(QDF_MODULE_ID_HDD); if (wlan_hdd_validate_context(hdd_ctx)) return; + if (frame_ind->frame_len < ieee80211_hdrlen(mgmt->frame_control)) { + hdd_err(" Invalid frame length"); + return; + } + if (SME_SESSION_ID_ANY == frame_ind->sessionId) { for (i = 0; i < CSR_ROAM_SESSION_MAX; i++) { adapter =