A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-14 00:24:41 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacmn: Fix out of bound read issue in ESP ie parse

Browse source 
During esp ie parse from beacon/probe response, the data pointer
is getting read from esp ie and it's not validate while updating
to esp params which may cause out of bound read issue.

Validate data pointer before updating to esp params.

Change-Id: I1167b82248613cc65fcd7c70cdcfe57595de6b21
CRs-Fixed: 2842234
This commit is contained in:
Jyoti Kumari 2021-01-03 16:05:25 +05:30 • committed by Gerrit - the friendly Code Review server
commit e0ebe0b6e2
1 changed files with 3 additions and 2 deletions
Download patch file Download diff file Expand all files Collapse all files

5
umac/scan/dispatcher/src/wlan_scan_utils_api.c
View file

@ -1,5 +1,5 @@
/*
* Copyright (c) 2017-2020 The Linux Foundation. All rights reserved.
* Copyright (c) 2017-2021 The Linux Foundation. All rights reserved.
*
* Permission to use, copy, modify, and/or distribute this software for
* any purpose with or without fee is hereby granted, provided that the
@ -1197,7 +1197,8 @@ static void util_scan_update_esp_data(struct wlan_esp_ie *esp_information,
return;
}
for (i = 0; i < total_elements; i++) {
for (i = 0; i < total_elements &&
data < ((uint8_t *)esp_ie + esp_ie->esp_len + 3); i++) {
esp_info = (struct wlan_esp_info *)data;
if (esp_info->access_category == ESP_AC_BK) {
qdf_mem_copy(&esp_information->esp_info_AC_BK,