From 4bea8b4d2becde7e435fa1ba708b632a33907091 Mon Sep 17 00:00:00 2001
From: Nachiket Kukade <nkukade@codeaurora.org>
Date: Tue, 13 Jun 2017 11:53:19 +0530
Subject: [PATCH] qcacld-3.0: Check on IE length to avoid buffer over-read

An incorrect IE length can overflow the remaining length variable
and make IE parsing logic perform a buffer over-read.
Check on IE length to avoid buffer over-read.

Change-Id: I20ef6a0136c7a5b602ad15a2fb725f20807b81d0
CRs-Fixed: 2052804
---
 core/hdd/src/wlan_hdd_cfg80211.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/core/hdd/src/wlan_hdd_cfg80211.c b/core/hdd/src/wlan_hdd_cfg80211.c
index b48949c23ed4..4ccc55ac0558 100644
--- a/core/hdd/src/wlan_hdd_cfg80211.c
+++ b/core/hdd/src/wlan_hdd_cfg80211.c
@@ -14450,6 +14450,14 @@ static int wlan_hdd_cfg80211_set_ie(hdd_adapter_t *pAdapter, const uint8_t *ie,
 		eLen = *genie++;
 		remLen -= 2;
 
+		/* Sanity check on eLen */
+		if (eLen > remLen) {
+			hdd_err("%s: Invalid IE length[%d] for IE[0x%X]",
+				__func__, eLen, elementId);
+			QDF_ASSERT(0);
+			return -EINVAL;
+		}
+
 		hdd_debug("IE[0x%X], LEN[%d]", elementId, eLen);
 
 		switch (elementId) {