A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-15 01:01:56 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix buffer overflow in wmi roam scan filter cmd

Browse source 
The length of buffer used to send wmi roam scan filter cmd is not
properly calculated and the length is less than the data to be copied.

Fix it by properly calculating the length of the buffer.

Change-Id: I971ff3c1313d617cc3174150c738ba20f931d2a1
CRs-Fixed: 2072064
This commit is contained in:
Abhishek Singh 2017-07-06 11:24:11 +05:30 • committed by snandini
commit 2e1a11a6b0
1 changed files with 1 additions and 13 deletions
Download patch file Download diff file Expand all files Collapse all files

14
core/wma/src/wma_scan_roam.c
View file

@ -1577,7 +1577,7 @@ static QDF_STATUS wma_roam_scan_filter(tp_wma_handle wma_handle,
{
int i;
QDF_STATUS status = QDF_STATUS_SUCCESS;
uint32_t len = 0, num_bssid_black_list = 0, num_ssid_white_list = 0,
uint32_t num_bssid_black_list = 0, num_ssid_white_list = 0,
num_bssid_preferred_list = 0;
uint32_t op_bitmap = 0;
struct roam_ext_params *roam_params;
@ -1596,23 +1596,16 @@ static QDF_STATUS wma_roam_scan_filter(tp_wma_handle wma_handle,
op_bitmap |= 0x1;
num_bssid_black_list =
roam_params->num_bssid_avoid_list;
len = num_bssid_black_list * sizeof(wmi_mac_addr);
len += WMI_TLV_HDR_SIZE;
break;
case REASON_ROAM_SET_SSID_ALLOWED:
op_bitmap |= 0x2;
num_ssid_white_list =
roam_params->num_ssid_allowed_list;
len = num_ssid_white_list * sizeof(wmi_ssid);
len += WMI_TLV_HDR_SIZE;
break;
case REASON_ROAM_SET_FAVORED_BSSID:
op_bitmap |= 0x4;
num_bssid_preferred_list =
roam_params->num_bssid_favored;
len = num_bssid_preferred_list * sizeof(wmi_mac_addr);
len += WMI_TLV_HDR_SIZE;
len += num_bssid_preferred_list * sizeof(A_UINT32);
break;
default:
WMA_LOGD("%s : Roam Filter need not be sent", __func__);
@ -1626,11 +1619,7 @@ static QDF_STATUS wma_roam_scan_filter(tp_wma_handle wma_handle,
*/
op_bitmap = 0x2 | 0x4;
num_ssid_white_list = roam_params->num_ssid_allowed_list;
len = num_ssid_white_list * sizeof(wmi_ssid);
num_bssid_preferred_list = roam_params->num_bssid_favored;
len += num_bssid_preferred_list * sizeof(wmi_mac_addr);
len += num_bssid_preferred_list * sizeof(A_UINT32);
len += (2 * WMI_TLV_HDR_SIZE);
}
/* fill in fixed values */
@ -1639,7 +1628,6 @@ static QDF_STATUS wma_roam_scan_filter(tp_wma_handle wma_handle,
params->num_bssid_black_list = num_bssid_black_list;
params->num_ssid_white_list = num_ssid_white_list;
params->num_bssid_preferred_list = num_bssid_preferred_list;
params->len = len;
qdf_mem_copy(params->bssid_avoid_list, roam_params->bssid_avoid_list,
MAX_BSSID_AVOID_LIST * sizeof(struct qdf_mac_addr));