A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-14 16:46:15 -04:00
Code Issues Projects Releases Packages Wiki Activity

qcacld-3.0: Resolve out of bound memory access while processing VSIEs

Browse source 
Currently elem_len is not checked against WPS_OUI_TYPE_SIZE
before it uses the buffer for memcmp, this may cause the buffer
overread.

To fix this add the proper comparision logic before the API uses
the buffer.

Change-Id: I9ba63543a529fb88932500be39045fcc19509863
CRs-Fixed: 2061159
This commit is contained in:
Ashish Kumar Dhanotiya 2017-06-14 18:06:01 +05:30 • committed by snandini
commit ff252beffa
1 changed files with 1 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

2
core/hdd/src/wlan_hdd_hostapd.c
View file

@ -6688,7 +6688,7 @@ static void wlan_hdd_add_hostapd_conf_vsie(hdd_adapter_t *pHostapdAdapter,
elem_id = ptr[0];
elem_len = ptr[1];
left -= 2;
if (elem_len > left) {
if (elem_len > left || elem_len < WPS_OUI_TYPE_SIZE) {
hdd_err("**Invalid IEs eid: %d elem_len: %d left: %d**",
elem_id, elem_len, left);
return;