From 77a8a13b1b99a6f7b0c335a1ff9a716de0d3dc02 Mon Sep 17 00:00:00 2001 From: Pragaspathi Thilagaraj Date: Thu, 5 Dec 2019 19:55:28 +0530 Subject: [PATCH] qcacld-3.0: Fix integer overflow in rrm_fill_beacon_ies() In function rrm_fill_beacon_ies, the total IE length is calculated as sum of length field of the IE and 2 (element id 1 byte and IE length field 1 byte). The total IE length is defined of type uint16_t and will overflow if the *(pBcnIes + 1)=0xfe. Validate the len against total IE length to avoid overflow. Change-Id: If8f86952ce43c5923906fc6ef18705f1785c5d88 CRs-Fixed: 2573329 --- core/mac/src/pe/rrm/rrm_api.c | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/core/mac/src/pe/rrm/rrm_api.c b/core/mac/src/pe/rrm/rrm_api.c index f550088b6e59..0898b6f9dabf 100644 --- a/core/mac/src/pe/rrm/rrm_api.c +++ b/core/mac/src/pe/rrm/rrm_api.c @@ -747,10 +747,17 @@ rrm_fill_beacon_ies(struct mac_context *mac, uint8_t *pIes, } while (BcnNumIes > 0) { - len = *(pBcnIes + 1) + 2; /* element id + length. */ + len = *(pBcnIes + 1); + len += 2; /* element id + length. */ pe_debug("EID = %d, len = %d total = %d", *pBcnIes, *(pBcnIes + 1), len); + if (BcnNumIes < len) { + pe_err("RRM: Invalid IE len:%d exp_len:%d", + len, BcnNumIes); + break; + } + if (len <= 2) { pe_err("RRM: Invalid IE"); break;