Эх сурвалжийг харах

qcacld-3.0: Fix buf overflow in __wlan_hdd_cfg80211_update_connect_params

Currently, number of bytes being copied into keyname_nai buffer is
key_nai_length, which can be greater than FILS_MAX_KEYNAME_NAI_LENGTH.
But the size of keyname_nai is limited to FILS_MAX_KEYNAME_NAI_LENGTH,
which may cause buffer overflow.

To address this issue, add check for key_nai_length against
FILS_MAX_KEYNAME_NAI_LENGTH to ensure buffer overflow does not happen.

Change-Id: I88c89b1fef6fdb1c4bd93e0fb8f3e54634b4940f
CRs-Fixed: 2208881
Dundi Raviteja 7 жил өмнө
parent
commit
170d287f1d

+ 6 - 0
core/hdd/src/wlan_hdd_cfg80211.c

@@ -22170,6 +22170,12 @@ static int __wlan_hdd_cfg80211_update_connect_params(
 		fils_info->key_nai_length = req->fils_erp_username_len +
 					    sizeof(char) +
 					    req->fils_erp_realm_len;
+		if (fils_info->key_nai_length >
+		    FILS_MAX_KEYNAME_NAI_LENGTH) {
+			hdd_err("Key NAI Length %d",
+				fils_info->key_nai_length);
+			return -EINVAL;
+		}
 		if (req->fils_erp_username_len && req->fils_erp_username) {
 			buf = fils_info->keyname_nai;
 			qdf_mem_copy(buf, req->fils_erp_username,