A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-11-10 12:52:37 -05:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Check on IE length to avoid buffer over-read

Browse source 
An incorrect IE length can overflow the remaining length variable
and make IE parsing logic perform a buffer over-read.
Check on IE length to avoid buffer over-read.

Change-Id: I20ef6a0136c7a5b602ad15a2fb725f20807b81d0
CRs-Fixed: 2052804
This commit is contained in:
Nachiket Kukade 2017-06-13 11:53:19 +05:30 • committed by snandini
commit 4bea8b4d2b
1 changed files with 8 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
core/hdd/src/wlan_hdd_cfg80211.c
View file

@ -14450,6 +14450,14 @@ static int wlan_hdd_cfg80211_set_ie(hdd_adapter_t *pAdapter, const uint8_t *ie,
eLen = *genie++;
remLen -= 2;
/* Sanity check on eLen */
if (eLen > remLen) {
hdd_err("%s: Invalid IE length[%d] for IE[0x%X]",
__func__, eLen, elementId);
QDF_ASSERT(0);
return -EINVAL;
}
hdd_debug("IE[0x%X], LEN[%d]", elementId, eLen);
switch (elementId) {