A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-25 06:03:36 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Fix possible OOB access in lim_process_disassoc_frame

Browse source 
Reason code is extracted from frame data without validating
the frame len which could result in out of bound access.

Fix is to validate frame len before extracting reason
code from frame data.

Change-Id: I00795a806abcae903dd0daa019aeab990aedc3a7
CRs-Fixed: 2253984
This commit is contained in:
Yeshwanth Sriram Guntuka 2018-06-11 17:41:18 +05:30 • committed by nshrivas
commit a00bca1118
1 changed files with 8 additions and 5 deletions
Download patch file Download diff file Expand all files Collapse all files

13
core/mac/src/pe/lim/lim_process_disassoc_frame.c
View file

@ -68,13 +68,12 @@ lim_process_disassoc_frame(tpAniSirGlobal pMac, uint8_t *pRxPacketInfo,
uint16_t aid, reasonCode;
tpSirMacMgmtHdr pHdr;
tpDphHashNode pStaDs;
#ifdef WLAN_FEATURE_11W
uint32_t frameLen;
#endif
uint32_t frame_len;
int32_t frame_rssi;
pHdr = WMA_GET_RX_MAC_HEADER(pRxPacketInfo);
pBody = WMA_GET_RX_MPDU_DATA(pRxPacketInfo);
frame_len = WMA_GET_RX_PAYLOAD_LEN(pRxPacketInfo);
frame_rssi = (int32_t)WMA_GET_RX_RSSI_NORMALIZED(pRxPacketInfo);
@ -128,11 +127,10 @@ lim_process_disassoc_frame(tpAniSirGlobal pMac, uint8_t *pRxPacketInfo,
/* If the frame received is unprotected, forward it to the supplicant to initiate */
/* an SA query */
frameLen = WMA_GET_RX_PAYLOAD_LEN(pRxPacketInfo);
/* send the unprotected frame indication to SME */
lim_send_sme_unprotected_mgmt_frame_ind(pMac, pHdr->fc.subType,
(uint8_t *) pHdr,
(frameLen +
(frame_len +
sizeof(tSirMacMgmtHdr)),
psessionEntry->smeSessionId,
psessionEntry);
@ -140,6 +138,11 @@ lim_process_disassoc_frame(tpAniSirGlobal pMac, uint8_t *pRxPacketInfo,
}
#endif
if (frame_len < 2) {
pe_err("frame len less than 2");
return;
}
/* Get reasonCode from Disassociation frame body */
reasonCode = sir_read_u16(pBody);