A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-11-10 12:52:37 -05:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Add maximum bound check on WPA RSN IE length

Browse source 
WPA RSN IE is copied from source without a check on the given IE length.
A malicious IE length can cause buffer overflow.
Add maximum bound check on WPA RSN IE length.

Change-Id: Id159d307e8f9c1de720d4553a7c29f23cbd28571
CRs-Fixed: 2052791
This commit is contained in:
Nachiket Kukade 2017-06-13 17:45:46 +05:30 • committed by snandini
commit 2f6509fce7
1 changed files with 6 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
core/hdd/src/wlan_hdd_cfg80211.c
View file

@ -14480,6 +14480,12 @@ static int wlan_hdd_cfg80211_set_ie(hdd_adapter_t *pAdapter, const uint8_t *ie,
pWextState->roamProfile.nAddIEAssocLength =
pWextState->assocAddIE.length;
} else if (0 == memcmp(&genie[0], "\x00\x50\xf2", 3)) {
if (eLen > (MAX_WPA_RSN_IE_LEN - 2)) {
hdd_err("%s: Invalid WPA IE length[%d]",
__func__, eLen);
QDF_ASSERT(0);
return -EINVAL;
}
hdd_debug("Set WPA IE (len %d)", eLen + 2);
memset(pWextState->WPARSNIE, 0,
MAX_WPA_RSN_IE_LEN);