From f33a4f5a7d5b0b54b72f6775a450575fc82a2fd8 Mon Sep 17 00:00:00 2001 From: Kiran Kumar Lokere Date: Mon, 9 Sep 2024 16:07:29 -0700 Subject: [PATCH] qcacld-3.0: Fix the possible OOB write in country IE unpack Fix the possible OOB write in unpacking the country IE due to the IE length check against integer division. CRs-Fixed: 3910626 Change-Id: I800290ab7285fb46ed43a46ce38967046b4881fa (cherry picked from commit 0002f9ddc9a6be3e34fe15e55f286b5794b29f08) --- core/mac/src/include/dot11f.h | 2 +- core/mac/src/sys/legacy/src/utils/src/dot11f.c | 6 +++--- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/core/mac/src/include/dot11f.h b/core/mac/src/include/dot11f.h index 7b0afc593596..338a943facae 100644 --- a/core/mac/src/include/dot11f.h +++ b/core/mac/src/include/dot11f.h @@ -27,7 +27,7 @@ * * * This file was automatically generated by 'framesc' - * Mon May 30 20:50:39 2022 from the following file(s): + * Wed Sep 11 12:49:28 2024 from the following file(s): * * dot11f.frms * diff --git a/core/mac/src/sys/legacy/src/utils/src/dot11f.c b/core/mac/src/sys/legacy/src/utils/src/dot11f.c index ec2f7ff8be51..b44f94ea0ba8 100644 --- a/core/mac/src/sys/legacy/src/utils/src/dot11f.c +++ b/core/mac/src/sys/legacy/src/utils/src/dot11f.c @@ -25,7 +25,7 @@ * * * This file was automatically generated by 'framesc' - * Mon May 30 20:50:39 2022 from the following file(s): + * Wed Sep 11 12:49:28 2024 from the following file(s): * * dot11f.frms * @@ -134,7 +134,7 @@ typedef struct sIEDefn { #define DOT11F_PARAMETER_CHECK2(pSrc, pBuf, nBuf, pnConsumed) \ do { \ if (!pSrc || IsBadReadPtr(pSrc, 4))\ - eturn DOT11F_BAD_INPUT_BUFFER; \ + return DOT11F_BAD_INPUT_BUFFER; \ if (!pBuf || IsBadWritePtr(pBuf, nBuf))\ return DOT11F_BAD_OUTPUT_BUFFER; \ if (!nBuf)\ @@ -4131,7 +4131,7 @@ uint32_t dot11f_unpack_ie_country(tpAniSirGlobal pCtx, return 0U; } else { pDst->num_more_triplets = (uint8_t)(ielen / 3); - if (ielen / 3 > 80) { + if (ielen > 80 * 3) { pDst->present = 0; return DOT11F_SKIPPED_BAD_IE; }