From e1f2b0e66aee32f477d3fbfcbcd6463181fd443c Mon Sep 17 00:00:00 2001 From: Jeff Johnson Date: Tue, 14 Nov 2017 14:42:55 -0800 Subject: [PATCH] qcacld-3.0: Validate kek_len in wlan_hdd_save_gtk_offload_params Although the kek_len should have already been validated before the function is called, update wlan_hdd_save_gtk_offload_params() to limit kek_len to the maximum allowed value before using it to copy the kek. Change-Id: I0676521171343c6fe58afcdc31477f555598c490 CRs-Fixed: 2140033 --- core/hdd/src/wlan_hdd_cfg80211.c | 8 +++++++- 1 file changed, 7 insertions(+), 1 deletion(-) diff --git a/core/hdd/src/wlan_hdd_cfg80211.c b/core/hdd/src/wlan_hdd_cfg80211.c index bb18d1f6e180..e9a2e65cefb5 100644 --- a/core/hdd/src/wlan_hdd_cfg80211.c +++ b/core/hdd/src/wlan_hdd_cfg80211.c @@ -5549,8 +5549,14 @@ void wlan_hdd_save_gtk_offload_params(struct hdd_adapter *adapter, if (kck_ptr) qdf_mem_copy(gtk_req->kck, kck_ptr, NL80211_KCK_LEN); - if (kek_ptr) + if (kek_ptr) { + /* paranoia */ + if (kek_len > sizeof(gtk_req->kek)) { + kek_len = sizeof(gtk_req->kek); + QDF_ASSERT(0); + } qdf_mem_copy(gtk_req->kek, kek_ptr, kek_len); + } qdf_copy_macaddr(>k_req->bssid, &hdd_sta_ctx->conn_info.bssId);