A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-11 07:03:09 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Add length check in wma_process_rmf_frame

Browse source 
The driver verifies the replay_attack in protected
management frames in the API wma_is_ccmp_pn_replay_attack
The API expects a CCMP header pointer, but it may happen that
the size of the total frame is less than the size of ieee frame
+ the CCMP header length. In that case the CCMP pointer will
point to some memory location  not allocated to the frame, which
will result to out of bound access.

Fix is to add a length check to memory allocated to wbuf in
wma_process_rmf_frame

Change-Id: I351fa671cb8728843c8843c27dd91bcb201abb42
CRs-Fixed: 2230976
This commit is contained in:
gaurank kathpalia 2018-05-10 15:37:35 +05:30 • committed by nshrivas
commit a4a012ca2e
1 changed files with 13 additions and 7 deletions
Download patch file Download diff file Expand all files Collapse all files

20
core/wma/src/wma_mgmt.c
View file

@ -3431,6 +3431,19 @@ int wma_process_rmf_frame(tp_wma_handle wma_handle,
cds_pkt_return_packet(rx_pkt);
return -EINVAL;
}
if (iface->ucast_key_cipher == WMI_CIPHER_AES_GCM) {
hdr_len = WLAN_IEEE80211_GCMP_HEADERLEN;
mic_len = WLAN_IEEE80211_GCMP_MICLEN;
} else {
hdr_len = IEEE80211_CCMP_HEADERLEN;
mic_len = IEEE80211_CCMP_MICLEN;
}
if (qdf_nbuf_len(wbuf) < (sizeof(*wh) + hdr_len + mic_len)) {
WMA_LOGE("Buffer length less than expected %d",
(int)qdf_nbuf_len(wbuf));
cds_pkt_return_packet(rx_pkt);
return -EINVAL;
}
orig_hdr = (uint8_t *) qdf_nbuf_data(wbuf);
/* Pointer to head of CCMP header */
@ -3442,13 +3455,6 @@ int wma_process_rmf_frame(tp_wma_handle wma_handle,
return -EINVAL;
}
if (iface->ucast_key_cipher == WMI_CIPHER_AES_GCM) {
hdr_len = WLAN_IEEE80211_GCMP_HEADERLEN;
mic_len = WLAN_IEEE80211_GCMP_MICLEN;
} else {
hdr_len = IEEE80211_CCMP_HEADERLEN;
mic_len = IEEE80211_CCMP_MICLEN;
}
/* Strip privacy headers (and trailer)
* for a received frame
*/