From 76ee4d735fa3786a7f295b94fd08b6dc84174bce Mon Sep 17 00:00:00 2001 From: Chaoli Zhou Date: Wed, 23 Dec 2020 14:27:03 +0800 Subject: [PATCH] qcacmn: Fix OOB issue for bwnss oui If is_bwnss_oui return true in util_scan_parse_vendor_ie, and it will run into below logical: scan_params->ie_list.bwnss_map = (((uint8_t *)ie) + 8) But in fact if ie->ie_len < 6, it will casue read out of boundary issue. So add the length chekcing before reading it Change-Id: I0cdf723154eb808f8062efd897f9d67d54d4573b CRs-Fixed: 2838849 --- umac/cmn_services/cmn_defs/inc/wlan_cmn_ieee80211.h | 2 ++ umac/scan/dispatcher/src/wlan_scan_utils_api.c | 3 ++- 2 files changed, 4 insertions(+), 1 deletion(-) diff --git a/umac/cmn_services/cmn_defs/inc/wlan_cmn_ieee80211.h b/umac/cmn_services/cmn_defs/inc/wlan_cmn_ieee80211.h index 395072998bd3..95b60c944394 100644 --- a/umac/cmn_services/cmn_defs/inc/wlan_cmn_ieee80211.h +++ b/umac/cmn_services/cmn_defs/inc/wlan_cmn_ieee80211.h @@ -1828,6 +1828,8 @@ is_bwnss_oui(uint8_t *frm) ((ATH_OUI_BW_NSS_MAP_TYPE << 24) | ATH_OUI)); } +#define WLAN_BWNSS_MAP_OFFSET 6 + /** * is_he_cap_oui() - If vendor IE is HE CAP OUI * @frm: vendor IE pointer diff --git a/umac/scan/dispatcher/src/wlan_scan_utils_api.c b/umac/scan/dispatcher/src/wlan_scan_utils_api.c index 03b96d12d704..6ce36217d859 100644 --- a/umac/scan/dispatcher/src/wlan_scan_utils_api.c +++ b/umac/scan/dispatcher/src/wlan_scan_utils_api.c @@ -871,7 +871,8 @@ util_scan_parse_vendor_ie(struct scan_cache_entry *scan_params, * Bandwidth-NSS map has sub-type & version. * hence copy data just after version byte */ - scan_params->ie_list.bwnss_map = (((uint8_t *)ie) + 8); + if (ie->ie_len > WLAN_BWNSS_MAP_OFFSET) + scan_params->ie_list.bwnss_map = (((uint8_t *)ie) + 8); } else if (is_mbo_oce_oui((uint8_t *)ie)) { scan_params->ie_list.mbo_oce = (uint8_t *)ie; } else if (is_extender_oui((uint8_t *)ie)) {