Kaynağa Gözat

qcacld-3.0: Prevent buffer overflow

qcacld-2.0 to qcacld-3.0 propagation

In function wlanqcmbr_mc_process_msg, variable data_len
is from message, which should not be trusted. Buffer
overflow will happen if using it directory to copy data
to utf_buf.

Change-Id: I21479f510b95e6ced214f80d942db919837e8324
CRs-Fixed: 2116449
Paul Zhang 7 yıl önce
ebeveyn
işleme
008413c774
1 değiştirilmiş dosya ile 3 ekleme ve 0 silme
  1. 3 0
      core/hdd/src/wlan_hdd_ftm.c

+ 3 - 0
core/hdd/src/wlan_hdd_ftm.c

@@ -333,6 +333,9 @@ static void wlanqcmbr_mc_process_msg(void *message)
 	uint32_t data_len;
 
 	data_len = *((uint32_t *) message) + sizeof(uint32_t);
+	if (data_len > MAX_UTF_LENGTH + 4)
+		return;
+
 	qcmbr_buf = qdf_mem_malloc(sizeof(*qcmbr_buf));
 	if (qcmbr_buf != NULL) {
 		memcpy(qcmbr_buf->utf_buf, message, data_len);