A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-12 15:49:17 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: Possible OOB write in send_roam_scan_offload_mode_cmd_tlv

Browse source 
While preparing roam offload buffer, possible out of bound write
for pmk buffer in send_roam_scan_offload_mode_cmd_tlv.

Change-Id: Iadaf8261ef4440c7cb282af7b1321ebc5d08b5e5
CRs-Fixed: 2579401
This commit is contained in:
Abhinav Kumar 2019-12-04 11:48:10 +05:30 • committed by nshrivas
commit b2669ba62b
1 changed files with 7 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

9
wmi/src/wmi_unified_roam_tlv.c
View file

@ -1339,10 +1339,15 @@ send_roam_scan_offload_mode_cmd_tlv(wmi_unified_t wmi_handle,
WMI_LOGI("LFR3:PMKSA caching disabled");
}
roam_offload_11i->pmk_len = roam_req->pmk_len >
ROAM_OFFLOAD_PMK_BYTES ?
ROAM_OFFLOAD_PMK_BYTES :
roam_req->pmk_len;
qdf_mem_copy(roam_offload_11i->pmk,
roam_req->psk_pmk,
sizeof(roam_offload_11i->pmk));
roam_offload_11i->pmk_len = roam_req->pmk_len;
roam_offload_11i->pmk_len);
WMITLV_SET_HDR(&roam_offload_11i->tlv_header,
WMITLV_TAG_STRUC_wmi_roam_11i_offload_tlv_param,
WMITLV_GET_STRUCT_TLVLEN