A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-11 07:03:09 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: Fix out of bound read issue in ESP ie parse

Browse source 
While parsing ESP IE from beacon/probe response frame,
the condition in loop to copy ESP_INFO from the ESP IE is
incorrect which will iterate for 5 times rather than 4 times,
this may cause OOB access.

data < ((uint8_t *)esp_ie + esp_ie->esp_len + 3)
Here adding 3 for esp_ie->esp_len, actually esp_len itself is
1 byte extra (esp_ len = ESP_ID_EXTN + ESP_INFO * 4),
but by adding 3 again will loop for one more iteration
this will cause OOB access.

Remove 3 in loop condition to avoid one more extra iteration
and ignore ESP_ID_EXTN element for total elements, in function
util_scan_update_esp_data.

Change-Id: Ia9226e483672369af36c6914e3ac914fe9de45e5
CRs-Fixed: 3710081
(cherry picked from commit 799a747940)
This commit is contained in:
Krupali Dhanvijay 2024-02-05 17:41:02 +05:30 • committed by Surapusetty Naresh Babu
commit b36b22d2c7
1 changed files with 3 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

5
umac/scan/dispatcher/src/wlan_scan_utils_api.c
View file

@ -1221,7 +1221,8 @@ static void util_scan_update_esp_data(struct wlan_esp_ie *esp_information,
esp_ie = (struct wlan_esp_ie *)
util_scan_entry_esp_info(scan_entry);
total_elements = esp_ie->esp_len;
// Ignore ESP_ID_EXTN element
total_elements = esp_ie->esp_len - 1;
data = (uint8_t *)esp_ie + 3;
do_div(total_elements, ESP_INFORMATION_LIST_LENGTH);
@ -1231,7 +1232,7 @@ static void util_scan_update_esp_data(struct wlan_esp_ie *esp_information,
}
for (i = 0; i < total_elements &&
data < ((uint8_t *)esp_ie + esp_ie->esp_len + 3); i++) {
data < ((uint8_t *)esp_ie + esp_ie->esp_len); i++) {
esp_info = (struct wlan_esp_info *)data;
if (esp_info->access_category == ESP_AC_BK) {
qdf_mem_copy(&esp_information->esp_info_AC_BK,