Browse Source

qcacld-3.0: Fix OOB ready when find fils session ie

This change fixed potential OOB read when find fils session ie.

Change-Id: I385fccf11f8368ad63985bfb7fe25bf9fb7fe09d
CRs-Fixed: 3234954
Wu Gao 2 years ago
parent
commit
1a1ae8d89e
1 changed files with 2 additions and 2 deletions
  1. 2 2
      core/mac/src/pe/lim/lim_process_fils.c

+ 2 - 2
core/mac/src/pe/lim/lim_process_fils.c

@@ -1956,8 +1956,8 @@ static QDF_STATUS find_ie_data_after_fils_session_ie(struct mac_context *mac_ctx
 		if (elem_len > left)
 			return QDF_STATUS_E_FAILURE;
 
-		if (elem_id == WLAN_REQUEST_IE_MAX_LEN &&
-			ptr[2] == SIR_FILS_SESSION_EXT_EID) {
+		if ((elem_id == WLAN_REQUEST_IE_MAX_LEN) &&
+		    (left >= 3 && ptr[2] == SIR_FILS_SESSION_EXT_EID)) {
 			(*ie) = ((&ptr[1]) + ptr[1] + 1);
 			(*ie_len) = (left - elem_len);
 			return QDF_STATUS_SUCCESS;