A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-14 00:24:41 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Prevent possible OOB access in hdd_sendactionframe

Browse source 
In the function hdd_sendactionframe, the parameters passed include the
payload and the corresponding payload length; payload being generic
pointer. The payload is then typecasted into the destination structure
of type tpSirMacVendorSpecificFrameHdr. If the size of the payload
specified in payload_len is less than the size of the destination
structure, there is possiblility of OOB read while accessing the same.

To prevent this security vulnerability, add a sanity check for the
payload_len against the size of the destination structure.

Change-Id: Ib0e7b7bfcf78412d81f18cf887e5296d80272598
CRs-Fixed: 2517858
This commit is contained in:
Sourav Mohapatra 2019-09-05 14:34:19 +05:30 • committed by nshrivas
commit 762ed1e51a
1 changed files with 5 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

5
core/hdd/src/wlan_hdd_ioctl.c
View file

@ -1540,6 +1540,11 @@ hdd_sendactionframe(struct hdd_adapter *adapter, const uint8_t *bssid,
struct cfg80211_mgmt_tx_params params;
#endif
if (payload_len < sizeof(tSirMacVendorSpecificFrameHdr)) {
hdd_warn("Invalid payload length: %d", payload_len);
return -EINVAL;
}
if (QDF_STA_MODE != adapter->device_mode) {
hdd_warn("Unsupported in mode %s(%d)",
qdf_opmode_str(adapter->device_mode),