Bläddra i källkod

qcacld-3.0: Add sanity check for key_nai_length to prevent int underflow

In function csr_update_fils_params_rso, fils_info->key_nai_length
is used to calculate username_length and then subsequently to
calculate realm_len. If the value of key_nai_length received from
the framework is 0, the value of username_length would also be 0
thereby making realm_len as -1. However since realm_len is uint32,
the int value would underflow to a very large value leading to crash
at qdf_mem_copy.

Add sanity check to return if the value of key_nai_length is 0
or if the pointer to keyname_nai is NULL.

Change-Id: I9bfaa8f3be608bd90a0cd818be6627c9f12217c8
CRs-Fixed: 2141458
Vignesh Viswanathan 7 år sedan
förälder
incheckning
04f8795b03
1 ändrade filer med 5 tillägg och 0 borttagningar
  1. 5 0
      core/sme/src/csr/csr_api_roam.c

+ 5 - 0
core/sme/src/csr/csr_api_roam.c

@@ -18484,6 +18484,11 @@ static void csr_update_fils_params_rso(tpAniSirGlobal mac,
 	if (!fils_info || !req_buffer)
 		return;
 
+	if ((!fils_info->keyname_nai) || (!fils_info->key_nai_length)) {
+		sme_debug("key_nai_length is NULL");
+		return;
+	}
+
 	roam_fils_params = &req_buffer->roam_fils_params;
 	if ((fils_info->key_nai_length > FILS_MAX_KEYNAME_NAI_LENGTH) ||
 			(fils_info->r_rk_length > FILS_MAX_RRK_LENGTH)) {