From 9944a4c53cbb7d156089c959dfd5b46d43f06d69 Mon Sep 17 00:00:00 2001 From: Sheenam Monga Date: Wed, 17 Apr 2024 15:39:57 +0530 Subject: [PATCH] BACKPORT: qcacmn: Fix potential OOB read in util_scan_parse_rnr_ie Currently, while parsing scan RNR Ie data is moved to next neighbor_ap_info_field after parsing the current neighbor_ap_info_field. But in last iteration pointer may try to access invalid data if (uint8_t *)ie + rnr_ie_len + 2) bytes are less than sizeof neighbor_ap_info_field and same is the case with tbtt_length access. Fix is to add a length check of data + next data size to be parsed < (uint8_t *)ie + rnr_ie_len + 2) instead of adding a validation of data length only. CRs-Fixed: 3710080 Change-Id: I05e5a9a02f0f4f9bc468db894588e676f0a248c0 --- .../umac/scan/dispatcher/src/wlan_scan_utils_api.c | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/drivers/staging/qca-wifi-host-cmn/umac/scan/dispatcher/src/wlan_scan_utils_api.c b/drivers/staging/qca-wifi-host-cmn/umac/scan/dispatcher/src/wlan_scan_utils_api.c index c9fcd7db83a0..2075c773d12e 100644 --- a/drivers/staging/qca-wifi-host-cmn/umac/scan/dispatcher/src/wlan_scan_utils_api.c +++ b/drivers/staging/qca-wifi-host-cmn/umac/scan/dispatcher/src/wlan_scan_utils_api.c @@ -744,7 +744,8 @@ util_scan_parse_rnr_ie(struct scan_cache_entry *scan_entry, rnr_ie_len = ie->ie_len; data = (uint8_t *)ie + sizeof(struct ie_header); - while (data < ((uint8_t *)ie + rnr_ie_len + 2)) { + while ((data + sizeof(struct neighbor_ap_info_field)) <= + ((uint8_t *)ie + rnr_ie_len + 2)) { neighbor_ap_info = (struct neighbor_ap_info_field *)data; tbtt_count = neighbor_ap_info->tbtt_header.tbtt_info_count; tbtt_length = neighbor_ap_info->tbtt_header.tbtt_info_length; @@ -760,7 +761,8 @@ util_scan_parse_rnr_ie(struct scan_cache_entry *scan_entry, break; for (i = 0; i < (tbtt_count + 1) && - data < ((uint8_t *)ie + rnr_ie_len + 2); i++) { + (data + tbtt_length) <= + ((uint8_t *)ie + rnr_ie_len + 2); i++) { if (i < MAX_RNR_BSS) util_scan_update_rnr( &scan_entry->rnr.bss_info[i],