A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-12 15:49:17 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: Add check to avoid NULL pointer deference in parse MBSSID

Browse source 
In malformed beacon frame may deference the NULL pointer while
parsing MBSSID IE in util_scan_parse_mbssid will lead to crash.

Add check in util_scan_parse_mbsssid for split_prof_start before
passing to util_gen_new_ie and assign zero to split_prof_len
whenever split_prof_start freed to avoid unanticipated scenario.

Change-Id: Ibb9739d6b5d1775ab52d59f9aa5050ca693cd926
CRs-Fixed: 3717571
This commit is contained in:
Vinod Kumar Myadam 2024-02-19 14:29:13 +05:30 • committed by Ravindra Konda
commit 5336f4036a
1 changed files with 5 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
umac/scan/dispatcher/src/wlan_scan_utils_api.c
View file

@ -2524,6 +2524,8 @@ static QDF_STATUS util_scan_parse_mbssid(struct wlan_objmgr_pdev *pdev,
}
if (mbssid_info.split_prof_continue) {
if (!split_prof_start)
break;
nontx_profile = split_prof_start;
subie_len = split_prof_len;
} else {
@ -2541,6 +2543,7 @@ static QDF_STATUS util_scan_parse_mbssid(struct wlan_objmgr_pdev *pdev,
qdf_mem_free(split_prof_start);
split_prof_start = NULL;
split_prof_end = NULL;
split_prof_len = 0;
}
continue;
}
@ -2606,6 +2609,7 @@ static QDF_STATUS util_scan_parse_mbssid(struct wlan_objmgr_pdev *pdev,
qdf_mem_free(split_prof_start);
split_prof_start = NULL;
split_prof_end = NULL;
split_prof_len = 0;
qdf_mem_zero(&mbssid_info,
sizeof(mbssid_info));
}
@ -2620,6 +2624,7 @@ static QDF_STATUS util_scan_parse_mbssid(struct wlan_objmgr_pdev *pdev,
qdf_mem_free(split_prof_start);
split_prof_start = NULL;
split_prof_end = NULL;
split_prof_len = 0;
}
qdf_mem_free(new_frame);
}