Преглед изворни кода

qcacmn: Validate assoc request/response IE

Validate assoc request and response IE pointer
and length before sending the connect response
to the cfg80211 layer, else if there is a mismatch
between assoc request and response IE and length,
it would result in a panic.

CRs-Fixed: 3029994
Change-Id: I6bb285719c9749cb8c42306a95c392a01555d67f
Vivek пре 3 година
родитељ
комит
0d98962c76
1 измењених фајлова са 8 додато и 0 уклоњено
  1. 8 0
      os_if/linux/mlme/src/osif_cm_connect_rsp.c

+ 8 - 0
os_if/linux/mlme/src/osif_cm_connect_rsp.c

@@ -63,6 +63,10 @@ void osif_cm_get_assoc_req_ie_data(struct element_info *assoc_req,
 				   size_t *ie_data_len,
 				   const uint8_t **ie_data_ptr)
 {
+	/* Validate IE and length */
+	if (!assoc_req->len || !assoc_req->ptr)
+		return;
+
 	*ie_data_len = assoc_req->len;
 	*ie_data_ptr = assoc_req->ptr;
 }
@@ -71,6 +75,10 @@ void osif_cm_get_assoc_rsp_ie_data(struct element_info *assoc_rsp,
 				   size_t *ie_data_len,
 				   const uint8_t **ie_data_ptr)
 {
+	/* Validate IE and length */
+	if (!assoc_rsp->len || !assoc_rsp->ptr)
+		return;
+
 	*ie_data_len = assoc_rsp->len;
 	*ie_data_ptr = assoc_rsp->ptr;
 }