From b5422c951fd9e752b1838b37be496575823a4e79 Mon Sep 17 00:00:00 2001 From: Surya Prakash Sivaraj Date: Mon, 29 Jan 2024 17:01:25 +0530 Subject: [PATCH] qcacmn: Fix potential OOB read in util_scan_parse_mbssid() If the length of the MBSSID IE is 0, then there is a potential OOB read in util_scan_parse_mbssid(), when the Max BSSID indicator field is accessed. To fix this, do not proceed with MBSSID parsing if the length of the MBSSID IE is zero. Change-Id: I2c7a7641b77fed20a910cb77035588a7540caa62 CRs-Fixed: 3717567 --- umac/scan/dispatcher/src/wlan_scan_utils_api.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/umac/scan/dispatcher/src/wlan_scan_utils_api.c b/umac/scan/dispatcher/src/wlan_scan_utils_api.c index 8fac470063c3..e8b0b8ccb428 100644 --- a/umac/scan/dispatcher/src/wlan_scan_utils_api.c +++ b/umac/scan/dispatcher/src/wlan_scan_utils_api.c @@ -2341,6 +2341,15 @@ static QDF_STATUS util_scan_parse_mbssid(struct wlan_objmgr_pdev *pdev, if (!mbssid_elem) break; + /* + * The max_bssid_indicator field is mandatory, therefore the + * length of the MBSSID element should atleast be 1. + */ + if (!mbssid_elem[TAG_LEN_POS]) { + scm_debug_rl("MBSSID IE is of length zero"); + break; + } + mbssid_info.profile_count = (1 << mbssid_elem[MBSSID_INDICATOR_POS]);