From bc1b9eb34ade3b7412df524a388a51454e16e76b Mon Sep 17 00:00:00 2001 From: Bala Venkatesh Date: Wed, 8 Nov 2017 11:53:27 +0530 Subject: [PATCH] qcacld-3.0: Add check for fils_config_info->key_nai_len Add check for fils_config_info->key_nai_len to not exceed FILS_MAX_KEYNAME_NAI_LENGTH . If it exceeds this length then it causes out of bounds memory read issue for array keyname_nai Change-Id: I9ea6386e91e5eaea6a14bb2d13f0e030072b1262 CRs-Fixed: 2139906 --- core/mac/src/pe/lim/lim_process_fils.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/core/mac/src/pe/lim/lim_process_fils.c b/core/mac/src/pe/lim/lim_process_fils.c index 8c8e8341d449..cb9e64ef2293 100644 --- a/core/mac/src/pe/lim/lim_process_fils.c +++ b/core/mac/src/pe/lim/lim_process_fils.c @@ -1135,6 +1135,12 @@ void lim_update_fils_config(tpPESession session, csr_fils_info->akm = fils_config_info->akm_type; csr_fils_info->auth = fils_config_info->auth_type; csr_fils_info->sequence_number = fils_config_info->sequence_number; + if (fils_config_info->key_nai_length > FILS_MAX_KEYNAME_NAI_LENGTH) { + pe_err("Restricting the key_nai_length of %d to max %d", + fils_config_info->key_nai_length, + FILS_MAX_KEYNAME_NAI_LENGTH); + fils_config_info->key_nai_length = FILS_MAX_KEYNAME_NAI_LENGTH; + } csr_fils_info->keyname_nai_data = qdf_mem_malloc(fils_config_info->key_nai_length); if (!csr_fils_info->keyname_nai_data) {