A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-13 00:00:00 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Add check for set_ft_ies length

Browse source 
In file sme_ft_api.c, function sme_set_ft_ies(),
the ft_ies_length is user-controlled so there is
a possibility of integer overflow.

Add Sanity check to avoid integer overflow.

Change-Id: Idab80abeca35397be7ec13ca81c7ccb8be8ef256
CRs-Fixed: 2100965
This commit is contained in:
gaurank kathpalia 2017-11-01 10:45:40 +05:30 • committed by snandini
commit d6d79e884c
1 changed files with 3 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

3
core/sme/src/common/sme_ft_api.c
View file

@ -195,6 +195,9 @@ void sme_set_ft_ies(tHalHandle hal_ptr, uint32_t session_id,
* reassoc req. This is the new FT Roaming in place At
* this juncture we'r ready to start sending Reassoc req
*/
ft_ies_length = QDF_MIN(ft_ies_length, MAX_FTIE_SIZE);
sme_debug("New Reassoc Req: %pK in state %d",
ft_ies, session->ftSmeContext.FTState);
if ((session->ftSmeContext.reassoc_ft_ies) &&