A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-25 14:13:01 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Possible buffer overflow issue in wma

Browse source 
Possible bufer overflow risk in function
wmi_unified_bcn_tmpl_send.

Validate the beacon template length against
WMI_BEACON_TX_BUFFER_SIZE length to avoid overflow.

Change-Id: I98665de677f314f30a57991f48191f847718740c
CRs-Fixed: 2960714
This commit is contained in:
abhinav kumar 2021-06-04 19:45:08 +05:30 • committed by Madan Koyyalamudi
commit cda1c99777
1 changed files with 15 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

16
core/wma/src/wma_mgmt.c
View file

@ -2004,8 +2004,22 @@ static QDF_STATUS wma_unified_bcn_tmpl_send(tp_wma_handle wma,
tmpl_len = *(uint32_t *) &bcn_info->beacon[0];
else
tmpl_len = bcn_info->beaconLength;
if (p2p_ie_len)
if (tmpl_len > WMI_BEACON_TX_BUFFER_SIZE) {
wma_err("tmpl_len: %d > %d. Invalid tmpl len", tmpl_len,
WMI_BEACON_TX_BUFFER_SIZE);
return -EINVAL;
}
if (p2p_ie_len) {
if (tmpl_len <= p2p_ie_len) {
wma_err("tmpl_len %d <= p2p_ie_len %d, Invalid",
tmpl_len, p2p_ie_len);
return -EINVAL;
}
tmpl_len -= (uint32_t) p2p_ie_len;
}
frm = bcn_info->beacon + bytes_to_strip;
tmpl_len_aligned = roundup(tmpl_len, sizeof(A_UINT32));
/*