A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-10 22:40:54 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix possible OOB access in lim_process_assoc_req_frame

Browse source 
cfg_get_vendor_ie_ptr_from_oui is invoked in
lim_process_assoc_req_frame function with ie
pointer pointing to frame buffer plus assoc
req ie offset and ie len equal to frame buffer
len. This could result in OOB access since
offset is not subtracted from frame len.

Fix is to subtract the offset from frame len
as argument to cfg_get_vendor_ie_ptr_from_oui.

Change-Id: Ic107867bcf4d7813c544309a2aff165f2dc7155d
CRs-Fixed: 2255369
This commit is contained in:
Yeshwanth Sriram Guntuka 2018-06-14 18:44:41 +05:30 • committed by nshrivas
commit 9dea24ead3
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
core/mac/src/pe/lim/lim_process_assoc_req_frame.c
View file

@ -1935,7 +1935,7 @@ void lim_process_assoc_req_frame(tpAniSirGlobal mac_ctx, uint8_t *rx_pkt_info,
if (!wlan_get_vendor_ie_ptr_from_oui(
&session->access_policy_vendor_ie[2],
3, frm_body + LIM_ASSOC_REQ_IE_OFFSET,
frame_len)) {
frame_len - LIM_ASSOC_REQ_IE_OFFSET)) {
pe_err("Vendor ie not present and access policy is %x, Rejected association",
session->access_policy);
lim_send_assoc_rsp_mgmt_frame(mac_ctx,