A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-11 23:24:22 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix possible OOB access in lim_process_auth_frame

Browse source 
Key id is extracted from data buffer without validating
len of data which could result in out of bound access.

Fix is to validate frame len before extracting key id
from data buffer.

Change-Id: I1f4d88b7ca6201f03a6bc8e6915f1479f571838f
CRs-Fixed: 2254141
This commit is contained in:
Yeshwanth Sriram Guntuka 2018-06-07 14:58:29 +05:30 • committed by nshrivas
commit 72a91dbeaa
1 changed files with 8 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

8
core/mac/src/pe/lim/lim_process_auth_frame.c
View file

@ -1149,6 +1149,10 @@ lim_process_auth_frame(tpAniSirGlobal mac_ctx, uint8_t *rx_pkt_info,
body_ptr = WMA_GET_RX_MPDU_DATA(rx_pkt_info);
if (frame_len < 2) {
pe_err("invalid frame len: %d", frame_len);
return;
}
auth_alg = *(uint16_t *) body_ptr;
pe_debug("auth_alg %d ", auth_alg);
@ -1197,6 +1201,10 @@ lim_process_auth_frame(tpAniSirGlobal mac_ctx, uint8_t *rx_pkt_info,
mac_hdr->sa, pe_session, false);
goto free;
}
if (frame_len < 4) {
pe_err("invalid frame len: %d", frame_len);
goto free;
}
/* Extract key ID from IV (most 2 bits of 4th byte of IV) */
key_id = (*(body_ptr + 3)) >> 6;