A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-10 22:40:54 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: Fix OOB issue for bwnss oui

Browse source 
If is_bwnss_oui return true in util_scan_parse_vendor_ie,
and it will run into below logical:
scan_params->ie_list.bwnss_map = (((uint8_t *)ie) + 8)
But in fact if ie->ie_len < 6, it will casue read out
of boundary issue. So add the length chekcing before
reading it

Change-Id: I0cdf723154eb808f8062efd897f9d67d54d4573b
CRs-Fixed: 2838849
This commit is contained in:
Chaoli Zhou 2020-12-23 14:27:03 +08:00 • committed by snandini
commit 76ee4d735f
2 changed files with 4 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
umac/cmn_services/cmn_defs/inc/wlan_cmn_ieee80211.h
View file

@ -1828,6 +1828,8 @@ is_bwnss_oui(uint8_t *frm)
((ATH_OUI_BW_NSS_MAP_TYPE << 24) | ATH_OUI));
}
#define WLAN_BWNSS_MAP_OFFSET 6
/**
* is_he_cap_oui() - If vendor IE is HE CAP OUI
* @frm: vendor IE pointer

3
umac/scan/dispatcher/src/wlan_scan_utils_api.c
View file

@ -871,7 +871,8 @@ util_scan_parse_vendor_ie(struct scan_cache_entry *scan_params,
* Bandwidth-NSS map has sub-type & version.
* hence copy data just after version byte
*/
scan_params->ie_list.bwnss_map = (((uint8_t *)ie) + 8);
if (ie->ie_len > WLAN_BWNSS_MAP_OFFSET)
scan_params->ie_list.bwnss_map = (((uint8_t *)ie) + 8);
} else if (is_mbo_oce_oui((uint8_t *)ie)) {
scan_params->ie_list.mbo_oce = (uint8_t *)ie;
} else if (is_extender_oui((uint8_t *)ie)) {