A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-13 00:00:00 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Avoid buffer overflow in wma_process_bip

Browse source 
If 11w is enabled, mmie should be included in broadcast
multicast rmf, length check need consider it to avoid buffer
overflow

CRs-Fixed: 2270117
Change-Id: I6c2ebe18fb5b6e4246ba6d28c1dbc55175279e30
This commit is contained in:
Jianmin Zhu 2018-07-11 19:14:10 +08:00 • committed by nshrivas
commit d46bc4657f
1 changed files with 10 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

12
core/wma/src/wma_mgmt.c
View file

@ -3491,20 +3491,28 @@ int wma_process_bip(tp_wma_handle wma_handle,
qdf_nbuf_t wbuf
)
{
uint16_t mmie_size;
uint16_t key_id;
uint8_t *efrm;
efrm = qdf_nbuf_data(wbuf) + qdf_nbuf_len(wbuf);
if (iface->key.key_cipher == WMI_CIPHER_AES_CMAC) {
key_id = (uint16_t)*(efrm - cds_get_mmie_size() + 2);
mmie_size = cds_get_mmie_size();
} else if (iface->key.key_cipher == WMI_CIPHER_AES_GMAC) {
key_id = (uint16_t)*(efrm - cds_get_gmac_mmie_size() + 2);
mmie_size = cds_get_gmac_mmie_size();
} else {
WMA_LOGE(FL("Invalid key cipher %d"), iface->key.key_cipher);
return -EINVAL;
}
/* Check if frame is invalid length */
if (efrm - (uint8_t *)wh < sizeof(*wh) + mmie_size) {
WMA_LOGE(FL("Invalid frame length"));
return -EINVAL;
}
key_id = (uint16_t)*(efrm - mmie_size + 2);
if (!((key_id == WMA_IGTK_KEY_INDEX_4)
|| (key_id == WMA_IGTK_KEY_INDEX_5))) {
WMA_LOGE(FL("Invalid KeyID(%d) dropping the frame"), key_id);