A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-11 23:24:22 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: Fix potential OOB read in util_scan_parse_mbssid()

Browse source 
If the length of the MBSSID IE is 0, then there is a potential
OOB read in util_scan_parse_mbssid(), when the Max BSSID indicator
field is accessed.

To fix this, do not proceed with MBSSID parsing if the length
of the MBSSID IE is zero.

Change-Id: I2c7a7641b77fed20a910cb77035588a7540caa62
CRs-Fixed: 3717567
This commit is contained in:
Surya Prakash Sivaraj 2024-01-29 17:01:25 +05:30 • committed by Ravindra Konda
commit b5422c951f
1 changed files with 9 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

9
umac/scan/dispatcher/src/wlan_scan_utils_api.c
View file

@ -2341,6 +2341,15 @@ static QDF_STATUS util_scan_parse_mbssid(struct wlan_objmgr_pdev *pdev,
if (!mbssid_elem)
break;
/*
* The max_bssid_indicator field is mandatory, therefore the
* length of the MBSSID element should atleast be 1.
*/
if (!mbssid_elem[TAG_LEN_POS]) {
scm_debug_rl("MBSSID IE is of length zero");
break;
}
mbssid_info.profile_count =
(1 << mbssid_elem[MBSSID_INDICATOR_POS]);