A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-30 19:51:31 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: Fix possible buffer overflow in wma_encrypt_decrypt_msg_handler

Browse source 
Data len received in encrypt decrypt data response
is not validated against the max allowed size which
can result in buffer overflow.

Fix is to validate data len against max allowed size.

Change-Id: I69bd8e63014220e5a2f291e4a0b1914d10c79fd7
CRs-Fixed: 2226375
This commit is contained in:
Yeshwanth Sriram Guntuka 2018-06-22 18:25:45 +05:30 • committed by nshrivas
commit 985e8440d5
1 changed files with 3 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

4
wmi/src/wmi_unified_tlv.c
View file

@ -5886,7 +5886,9 @@ QDF_STATUS extract_encrypt_decrypt_resp_event_tlv(wmi_unified_t wmi_handle,
resp->vdev_id = data_event->vdev_id;
resp->status = data_event->status;
if (data_event->data_length > param_buf->num_enc80211_frame) {
if ((data_event->data_length > param_buf->num_enc80211_frame) ||
(data_event->data_length > WMI_SVC_MSG_MAX_SIZE - WMI_TLV_HDR_SIZE -
sizeof(*data_event))) {
WMI_LOGE("FW msg data_len %d more than TLV hdr %d",
data_event->data_length,
param_buf->num_enc80211_frame);