A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-13 00:00:00 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Add check for fils_config_info->key_nai_len

Browse source 
Add check for fils_config_info->key_nai_len to not exceed
FILS_MAX_KEYNAME_NAI_LENGTH . If it exceeds this length
then it causes out of bounds memory read issue for array keyname_nai

Change-Id: I9ea6386e91e5eaea6a14bb2d13f0e030072b1262
CRs-Fixed: 2139906
This commit is contained in:
Bala Venkatesh 2017-11-08 11:53:27 +05:30 • committed by snandini
commit bc1b9eb34a
1 changed files with 6 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

6
core/mac/src/pe/lim/lim_process_fils.c
View file

@ -1135,6 +1135,12 @@ void lim_update_fils_config(tpPESession session,
csr_fils_info->akm = fils_config_info->akm_type;
csr_fils_info->auth = fils_config_info->auth_type;
csr_fils_info->sequence_number = fils_config_info->sequence_number;
if (fils_config_info->key_nai_length > FILS_MAX_KEYNAME_NAI_LENGTH) {
pe_err("Restricting the key_nai_length of %d to max %d",
fils_config_info->key_nai_length,
FILS_MAX_KEYNAME_NAI_LENGTH);
fils_config_info->key_nai_length = FILS_MAX_KEYNAME_NAI_LENGTH;
}
csr_fils_info->keyname_nai_data =
qdf_mem_malloc(fils_config_info->key_nai_length);
if (!csr_fils_info->keyname_nai_data) {