A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-13 00:00:00 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Check buff len alloc in __iw_set_packet_filter_params

Browse source 
In __iw_set_packet_filter_params(), a user controlled length value,
priv_data.length, is used to allocated a buffer. This buffer is then
cast to a struct pointer of struct pkt_filter_cfg type without ensuring
the buffer is large enough to hold the struct. This can lead to a buffer
overread if the user supplied size is smaller than the actual size of the
struct.

Add a sanity check on priv_data.length to ensure that the size is large
enough to hold the struct.

Change-Id: I227856484d4bd7a9b0a16a42e26febbc799f80b5
CRs-Fixed: 2228725
This commit is contained in:
Sourav Mohapatra 2018-04-23 12:19:53 +05:30 • committed by nshrivas
commit debfc5a964
1 changed files with 2 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
core/hdd/src/wlan_hdd_wext.c
View file

@ -8245,7 +8245,8 @@ static int __iw_set_packet_filter_params(struct net_device *dev,
return -EINVAL;
}
if ((NULL == priv_data.pointer) || (0 == priv_data.length)) {
if ((NULL == priv_data.pointer) || (0 == priv_data.length) ||
priv_data.length < sizeof(struct pkt_filter_cfg)) {
hdd_err("invalid priv data %pK or invalid priv data length %d",
priv_data.pointer, priv_data.length);
return -EINVAL;