From a4a012ca2e0bcf4b5035dde60f36634871bca79f Mon Sep 17 00:00:00 2001 From: gaurank kathpalia Date: Thu, 10 May 2018 15:37:35 +0530 Subject: [PATCH] qcacld-3.0: Add length check in wma_process_rmf_frame The driver verifies the replay_attack in protected management frames in the API wma_is_ccmp_pn_replay_attack The API expects a CCMP header pointer, but it may happen that the size of the total frame is less than the size of ieee frame + the CCMP header length. In that case the CCMP pointer will point to some memory location not allocated to the frame, which will result to out of bound access. Fix is to add a length check to memory allocated to wbuf in wma_process_rmf_frame Change-Id: I351fa671cb8728843c8843c27dd91bcb201abb42 CRs-Fixed: 2230976 --- core/wma/src/wma_mgmt.c | 20 +++++++++++++------- 1 file changed, 13 insertions(+), 7 deletions(-) diff --git a/core/wma/src/wma_mgmt.c b/core/wma/src/wma_mgmt.c index f4a7fe043f98..65f88e744a00 100644 --- a/core/wma/src/wma_mgmt.c +++ b/core/wma/src/wma_mgmt.c @@ -3431,6 +3431,19 @@ int wma_process_rmf_frame(tp_wma_handle wma_handle, cds_pkt_return_packet(rx_pkt); return -EINVAL; } + if (iface->ucast_key_cipher == WMI_CIPHER_AES_GCM) { + hdr_len = WLAN_IEEE80211_GCMP_HEADERLEN; + mic_len = WLAN_IEEE80211_GCMP_MICLEN; + } else { + hdr_len = IEEE80211_CCMP_HEADERLEN; + mic_len = IEEE80211_CCMP_MICLEN; + } + if (qdf_nbuf_len(wbuf) < (sizeof(*wh) + hdr_len + mic_len)) { + WMA_LOGE("Buffer length less than expected %d", + (int)qdf_nbuf_len(wbuf)); + cds_pkt_return_packet(rx_pkt); + return -EINVAL; + } orig_hdr = (uint8_t *) qdf_nbuf_data(wbuf); /* Pointer to head of CCMP header */ @@ -3442,13 +3455,6 @@ int wma_process_rmf_frame(tp_wma_handle wma_handle, return -EINVAL; } - if (iface->ucast_key_cipher == WMI_CIPHER_AES_GCM) { - hdr_len = WLAN_IEEE80211_GCMP_HEADERLEN; - mic_len = WLAN_IEEE80211_GCMP_MICLEN; - } else { - hdr_len = IEEE80211_CCMP_HEADERLEN; - mic_len = IEEE80211_CCMP_MICLEN; - } /* Strip privacy headers (and trailer) * for a received frame */