Prechádzať zdrojové kódy

Merge "qcacmn: Fix potential OOB read in util_scan_is_split_prof_found()" into wlan-cmn.driver.lnx.2.0.14

CNSS_WLAN Service 1 rok pred
rodič
commit
2613f5f745

+ 3 - 0
umac/scan/dispatcher/src/wlan_scan_utils_api.c

@@ -3347,6 +3347,9 @@ static bool util_scan_is_split_prof_found(uint8_t *next_elem,
 {
 	uint8_t *next_mbssid_elem;
 
+	if ((next_elem + MIN_IE_LEN + VALID_ELEM_LEAST_LEN) > (ie + ielen))
+		return false;
+
 	if (next_elem[0] == WLAN_ELEMID_MULTIPLE_BSSID) {
 		if ((next_elem[TAG_LEN_POS] >= VALID_ELEM_LEAST_LEN) &&
 		    (next_elem[SUBELEM_DATA_POS_FROM_MBSSID] !=