From 96e0e702ec38f7d308cef8ae40cc73ecb96b775b Mon Sep 17 00:00:00 2001
From: Vignesh Viswanathan <viswanat@codeaurora.org>
Date: Tue, 5 Dec 2017 19:42:46 +0530
Subject: [PATCH] qcacld-3.0: Fix potential buffer overflow in
 wlan_hdd_cfg80211_set_ie

In function wlan_hdd_cfg80211_set_ie, RSN IE is parsed and copied
into the buffer  for length eLen + 2.
However, the buffer WPARSNIE is allocated only for
size. If eLen + 2 is greater than MAX_WPA_RSN_IE_LEN, a buffer overflow
would occur.

Add sanity check to make sure eLen does not exceed MAX_WPA_RSN_IE_LEN - 2.
Also increase the size of  to 255 as per the spec

Change-Id: Ibf44e8dc1010e6e32b2262357d3aa180926d5c99
CRs-Fixed: 2154216
---
 core/hdd/inc/wlan_hdd_wext.h     | 2 +-
 core/hdd/src/wlan_hdd_cfg80211.c | 5 +++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/core/hdd/inc/wlan_hdd_wext.h b/core/hdd/inc/wlan_hdd_wext.h
index 4bb3a6c8c299..158b88a0277a 100644
--- a/core/hdd/inc/wlan_hdd_wext.h
+++ b/core/hdd/inc/wlan_hdd_wext.h
@@ -153,7 +153,7 @@ enum hdd_wlan_wmm_ts_info_ack_policy {
 };
 
 /** Maximum Length of WPA/RSN IE */
-#define MAX_WPA_RSN_IE_LEN 40
+#define MAX_WPA_RSN_IE_LEN 255
 
 /** Enable 11d */
 #define ENABLE_11D  1
diff --git a/core/hdd/src/wlan_hdd_cfg80211.c b/core/hdd/src/wlan_hdd_cfg80211.c
index afa959484196..f9d59062014b 100644
--- a/core/hdd/src/wlan_hdd_cfg80211.c
+++ b/core/hdd/src/wlan_hdd_cfg80211.c
@@ -16889,6 +16889,11 @@ static int wlan_hdd_cfg80211_set_ie(struct hdd_adapter *adapter,
 			break;
 		case DOT11F_EID_RSN:
 			hdd_debug("Set RSN IE(len %d)", eLen + 2);
+			if (eLen > (MAX_WPA_RSN_IE_LEN - 2)) {
+				hdd_err("%s: Invalid WPA RSN IE length[%d]",
+					__func__, eLen);
+				return -EINVAL;
+			}
 			memset(pWextState->WPARSNIE, 0, MAX_WPA_RSN_IE_LEN);
 			memcpy(pWextState->WPARSNIE, genie - 2,
 			       (eLen + 2));