From cf88e3afefd238b63453f3a2890fc8df4ed6203f Mon Sep 17 00:00:00 2001 From: Rajeev Kumar Sirasanagandla Date: Tue, 29 May 2018 16:17:43 +0530 Subject: [PATCH] qcacld-3.0: Avoid buffer over-read in vendor scan While processing QCA_NL80211_VENDOR_SUBCMD_TRIGGER_SCAN, scan randomization attributes: SCAN_MAC and SCAN_MAC_MASK are not validated using nla_policy for a minimum length check of MAC_ADDR_SIZE (6 bytes) which can result in buffer over-read. To address this, add nla_policy for randomization attributes. Change-Id: I872e221b951809ca1e5c60b867be52b9fa738ddd CRs-Fixed: 2232745 --- core/hdd/src/wlan_hdd_scan.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/core/hdd/src/wlan_hdd_scan.c b/core/hdd/src/wlan_hdd_scan.c index 554baab771be..d24b33a65913 100644 --- a/core/hdd/src/wlan_hdd_scan.c +++ b/core/hdd/src/wlan_hdd_scan.c @@ -45,7 +45,6 @@ #endif #include #include - #include "wlan_utility.h" #define MAX_RATES 12 @@ -870,6 +869,10 @@ struct nla_policy scan_policy[QCA_WLAN_VENDOR_ATTR_SCAN_MAX + 1] = { [QCA_WLAN_VENDOR_ATTR_SCAN_COOKIE] = {.type = NLA_U64}, [QCA_WLAN_VENDOR_ATTR_SCAN_IE] = {.type = NLA_BINARY, .len = MAX_DEFAULT_SCAN_IE_LEN}, + [QCA_WLAN_VENDOR_ATTR_SCAN_MAC] = {.type = NLA_UNSPEC, + .len = QDF_MAC_ADDR_SIZE}, + [QCA_WLAN_VENDOR_ATTR_SCAN_MAC_MASK] = {.type = NLA_UNSPEC, + .len = QDF_MAC_ADDR_SIZE}, }; /**