From c303459d07819ce443e6e980c74688b16ca78eb7 Mon Sep 17 00:00:00 2001 From: "Kaushik K.N" Date: Thu, 7 Sep 2023 19:00:31 +0800 Subject: [PATCH 1/2] qcacmn: Fix issue about generating MBSSID frames When generating MBSSID beacon/probe response frames, it misses the last IE in the MBSSID ie list. To address it, correcting the comparing length. CRs-Fixed: 3609711 Change-Id: Ia406be0ade901c9bc01698faec473bd25c59dfb3 --- umac/scan/dispatcher/src/wlan_scan_utils_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/umac/scan/dispatcher/src/wlan_scan_utils_api.c b/umac/scan/dispatcher/src/wlan_scan_utils_api.c index c9fcd7db83a0..64498dc9b22c 100644 --- a/umac/scan/dispatcher/src/wlan_scan_utils_api.c +++ b/umac/scan/dispatcher/src/wlan_scan_utils_api.c @@ -2161,7 +2161,7 @@ static uint32_t util_gen_new_ie(uint8_t *ie, uint32_t ielen, tmp_new = sub_copy; while ((subie_len > 0) && (((tmp_new + tmp_new[1] + MIN_IE_LEN) - sub_copy) <= - (subie_len - 1))) { + subie_len)) { if (!(tmp_new[0] == WLAN_ELEMID_NONTX_BSSID_CAP || tmp_new[0] == WLAN_ELEMID_SSID || tmp_new[0] == WLAN_ELEMID_MULTI_BSSID_IDX || From a2450eb8bc188bdbaf38d7a6707ab1de99502832 Mon Sep 17 00:00:00 2001 From: "Kaushik K.N" Date: Thu, 9 May 2024 09:25:57 +0200 Subject: [PATCH 2/2] qcacmn: Fix length check to parse non-inheritance list Fix length check and add sub_copy and length subie_len checks before accessing extn_elem to avoid any OOB read. Change-Id: I85ea636d5fe64e8508e91b06f0302d5f6258e583 CRs-Fixed: 3800831 --- umac/scan/dispatcher/src/wlan_scan_utils_api.c | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/umac/scan/dispatcher/src/wlan_scan_utils_api.c b/umac/scan/dispatcher/src/wlan_scan_utils_api.c index 64498dc9b22c..b11c4ceca6ad 100644 --- a/umac/scan/dispatcher/src/wlan_scan_utils_api.c +++ b/umac/scan/dispatcher/src/wlan_scan_utils_api.c @@ -2019,7 +2019,7 @@ static uint32_t util_gen_new_ie(uint8_t *ie, uint32_t ielen, if (extn_elem && extn_elem[TAG_LEN_POS] >= VALID_ELEM_LEAST_LEN) { if (((extn_elem + extn_elem[1] + MIN_IE_LEN) - sub_copy) - < subie_len) + <= subie_len) util_parse_noninheritance_list(extn_elem, &elem_list, &extn_elem_list, &ninh); }