From d46bc4657f538afc75a50f4595637d74b45e2eaf Mon Sep 17 00:00:00 2001 From: Jianmin Zhu Date: Wed, 11 Jul 2018 19:14:10 +0800 Subject: [PATCH] qcacld-3.0: Avoid buffer overflow in wma_process_bip If 11w is enabled, mmie should be included in broadcast multicast rmf, length check need consider it to avoid buffer overflow CRs-Fixed: 2270117 Change-Id: I6c2ebe18fb5b6e4246ba6d28c1dbc55175279e30 --- core/wma/src/wma_mgmt.c | 12 ++++++++++-- 1 file changed, 10 insertions(+), 2 deletions(-) diff --git a/core/wma/src/wma_mgmt.c b/core/wma/src/wma_mgmt.c index 16b6e5e1586a..c10a310cc7e9 100644 --- a/core/wma/src/wma_mgmt.c +++ b/core/wma/src/wma_mgmt.c @@ -3491,20 +3491,28 @@ int wma_process_bip(tp_wma_handle wma_handle, qdf_nbuf_t wbuf ) { + uint16_t mmie_size; uint16_t key_id; uint8_t *efrm; efrm = qdf_nbuf_data(wbuf) + qdf_nbuf_len(wbuf); if (iface->key.key_cipher == WMI_CIPHER_AES_CMAC) { - key_id = (uint16_t)*(efrm - cds_get_mmie_size() + 2); + mmie_size = cds_get_mmie_size(); } else if (iface->key.key_cipher == WMI_CIPHER_AES_GMAC) { - key_id = (uint16_t)*(efrm - cds_get_gmac_mmie_size() + 2); + mmie_size = cds_get_gmac_mmie_size(); } else { WMA_LOGE(FL("Invalid key cipher %d"), iface->key.key_cipher); return -EINVAL; } + /* Check if frame is invalid length */ + if (efrm - (uint8_t *)wh < sizeof(*wh) + mmie_size) { + WMA_LOGE(FL("Invalid frame length")); + return -EINVAL; + } + + key_id = (uint16_t)*(efrm - mmie_size + 2); if (!((key_id == WMA_IGTK_KEY_INDEX_4) || (key_id == WMA_IGTK_KEY_INDEX_5))) { WMA_LOGE(FL("Invalid KeyID(%d) dropping the frame"), key_id);