From ad155b8503b25b60f4bb19a8ec665a4e7e29b95a Mon Sep 17 00:00:00 2001 From: Gururaj Pandurangi Date: Thu, 14 Oct 2021 18:54:56 -0700 Subject: [PATCH] qcacld-3.0: Avoid OOB read in sch_get_csa_ecsa_count_offset Avoid OOB read in sch_get_csa_ecsa_count_offset API by adding check for ie_len before subtracting element ID len from it. Change-Id: Id86e69b2c5abc37a4f33125dc5fd0bd1d92f64a7 CRs-Fixed: 3049251 --- core/mac/src/pe/sch/sch_beacon_gen.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/core/mac/src/pe/sch/sch_beacon_gen.c b/core/mac/src/pe/sch/sch_beacon_gen.c index fdc828b16d1f..3f6dd8d393c0 100644 --- a/core/mac/src/pe/sch/sch_beacon_gen.c +++ b/core/mac/src/pe/sch/sch_beacon_gen.c @@ -167,7 +167,7 @@ sch_append_addn_ie(struct mac_context *mac_ctx, struct pe_session *session, /** * sch_get_csa_ecsa_count_offset() - get the offset of Switch count field - * @ie: pointer to the beggining of IEs in the beacon frame buffer + * @ie: pointer to the beginning of IEs in the beacon frame buffer * @ie_len: length of the IEs in the buffer * @csa_count_offset: pointer to the csa_count_offset variable in the caller * @ecsa_count_offset: pointer to the ecsa_count_offset variable in the caller @@ -206,6 +206,9 @@ static void sch_get_csa_ecsa_count_offset(uint8_t *ie, uint32_t ie_len, *ecsa_count_offset = offset + SCH_ECSA_SWITCH_COUNT_OFFSET; + if (ie_len < elem_len) + return; + ie_len -= elem_len; offset += elem_len; ptr += (elem_len + 2);