A-Team_Digital_Solutions/android_kernel_motorola_sm6375
Watch
2
0
Fork
You've already forked android_kernel_motorola_sm6375
 0
mirror of https://github.com/BobTheBlinker/android_kernel_motorola_sm6375.git synced 2026-10-15 01:01:56 -04:00
Code Issues Projects Releases Packages Wiki Activity
android_kernel_motorola_sm6375/ftm
History
Repository files (latest commit first)
Filename Latest commit message Latest commit date
Pragaspathi Thilagaraj 68e058b24d qcacmn: Fix possible OOB write in wlan_ftm_process_utf_event 
The function wlan_ftm_process_utf_event, is invoked upon the
reception of the WMI event WMI_PDEV_UTF_EVENTID. The event_buf
argument to it is fully FW controlled.  There are two issues
here:
1. event.datalen of type uint32_t is assigned to utf_datalen of
type uint16_t which can lead to a possible integer underflow.
2. utf_datalen is calculated as the difference of event.datalen
and sizeof(seghdr_info), without validating if datalen is not
less than sizeof(seghdr_info). This could cause a potential OOB
write as utf_datalen is used as the size to copy utf_data to
ftm_pdev_obj->data.

Add fix to change the type of utf_datalen to uint32_t.

Change-Id: Ibd61b4ef8cd514d43f212174e745b1c76af1047d
CRs-Fixed: 2305477
2018-09-07 21:46:49 -07:00
..
core/src qcacmn: Converge FTM feature 2018-01-16 18:29:53 -08:00
dispatcher qcacmn: Fix possible OOB write in wlan_ftm_process_utf_event 2018-09-07 21:46:49 -07:00