A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-14 00:24:41 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: Fix OOB read in util_scan_gen_scan_entry

Browse source 
qdf_mem_copy() is called in util_scan_gen_scan_entry() to copy the ssid
into scan_entry using a length of WLAN_SSID_MAX_LEN. Because the length
of ssid is only checked against the maximum value this will result
in an OOB read of up to WLAN_SSID_MAX_LEN bytes.

Change-Id: I150e7c7a75e7134cab1c4abeb799578166400461
CRs-Fixed: 2341004
This commit is contained in:
Harprit Chhabada 2018-10-31 10:52:34 -07:00 • committed by nshrivas
commit ab6c10d3bd
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
umac/scan/dispatcher/src/wlan_scan_utils_api.c
View file

@ -1084,7 +1084,7 @@ util_scan_gen_scan_entry(struct wlan_objmgr_pdev *pdev,
scan_entry->ie_list.ssid = NULL;
} else {
qdf_mem_copy(scan_entry->ssid.ssid,
ssid->ssid, WLAN_SSID_MAX_LEN);
ssid->ssid, ssid->ssid_len);
scan_entry->ssid.length = ssid->ssid_len;
scan_entry->hidden_ssid_timestamp =
scan_entry->scan_entry_time;