From 59bf3d4bf0ac4444469c0071373a4a0cc7d92c86 Mon Sep 17 00:00:00 2001 From: Vignesh Viswanathan Date: Wed, 20 Dec 2017 19:58:58 +0530 Subject: [PATCH] qcacld-3.0: Fix potential OOB read in lim_parse_kde_elements In function lim_parse_kde_elements, while parsing the KDE list from the assoc response frame, elem_len is obtained from the frame buffer. elem_len is then used to find the matching OUI for KDE OUI type and then to calculate data_len based on the offset for the GTK/IGTK data types. If the value in elem_len field in the frame is less than the Data Offset (which includes the OUI and data type) or the GTK/IGTK offset then a OOB read would occur. Add checks to validate the elem_len with Data offset and then with the GTK/IGTK offset based on the data type. Change-Id: I8ae31c6d6c28e88ad9bda757b3f1ff2585f8a553 CRs-Fixed: 2161920 --- core/mac/src/pe/lim/lim_process_fils.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/core/mac/src/pe/lim/lim_process_fils.c b/core/mac/src/pe/lim/lim_process_fils.c index 55f9c1942b80..9a1e26eb5a99 100644 --- a/core/mac/src/pe/lim/lim_process_fils.c +++ b/core/mac/src/pe/lim/lim_process_fils.c @@ -1353,6 +1353,12 @@ static QDF_STATUS lim_parse_kde_elements(tpAniSirGlobal mac_ctx, return QDF_STATUS_E_FAILURE; } + if (elem_len < KDE_IE_DATA_OFFSET) { + pe_err("Not enough len to parse elem_len %d", + elem_len); + return QDF_STATUS_E_FAILURE; + } + if (lim_check_if_vendor_oui_match(mac_ctx, KDE_OUI_TYPE, KDE_OUI_TYPE_SIZE, current_ie, elem_len)) { @@ -1362,6 +1368,11 @@ static QDF_STATUS lim_parse_kde_elements(tpAniSirGlobal mac_ctx, switch (data_type) { case DATA_TYPE_GTK: + if (data_len < GTK_OFFSET) { + pe_err("Invalid KDE data_len %d", + data_len); + return QDF_STATUS_E_FAILURE; + } qdf_mem_copy(fils_info->gtk, (ie_data + GTK_OFFSET), (data_len - GTK_OFFSET)); @@ -1369,6 +1380,11 @@ static QDF_STATUS lim_parse_kde_elements(tpAniSirGlobal mac_ctx, break; case DATA_TYPE_IGTK: + if (data_len < IGTK_OFFSET) { + pe_err("Invalid KDE data_len %d", + data_len); + return QDF_STATUS_E_FAILURE; + } fils_info->igtk_len = (data_len - IGTK_OFFSET); qdf_mem_copy(fils_info->igtk, (ie_data + IGTK_OFFSET), (data_len -