A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-15 01:01:56 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: Fix possible OOB access while sending NAN msg to firmware

Browse source 
Fix possible OOB access while sending NAN msg to firmware, by checking
data len calculation against integer overflow and making sure data len
to be less than max wmi msg size.

Change-Id: I98f42b9924a1810282ae3bca031cd5a1e3dd4047
CRs-Fixed: 2205722
This commit is contained in:
Naveen Rawat 2018-05-08 09:40:10 -07:00 • committed by nshrivas
commit 92eefadac7
1 changed files with 12 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

12
wmi/src/wmi_unified_tlv.c
View file

@ -10424,6 +10424,18 @@ static QDF_STATUS send_nan_req_cmd_tlv(wmi_unified_t wmi_handle,
nan_data_len = nan_req->request_data_len;
nan_data_len_aligned = roundup(nan_req->request_data_len,
sizeof(uint32_t));
if (nan_data_len_aligned < nan_req->request_data_len) {
WMI_LOGE("%s: integer overflow while rounding up data_len",
__func__);
return QDF_STATUS_E_FAILURE;
}
if (nan_data_len_aligned > WMI_SVC_MSG_MAX_SIZE - WMI_TLV_HDR_SIZE) {
WMI_LOGE("%s: wmi_max_msg_size overflow for given datalen",
__func__);
return QDF_STATUS_E_FAILURE;
}
len += WMI_TLV_HDR_SIZE + nan_data_len_aligned;
buf = wmi_buf_alloc(wmi_handle, len);
if (!buf) {