Преглед на файлове

qcacld-3.0: Check possible OOB while strncmp

In hdd_tx_rx_is_dns_domain_name_match, during strncmp for
domain_name and dns_payload there may be possibility to access
data more than skb->len if track_dns_domain_len is corrupted.

Add a check to verify if track_dns_domain_len during strncmp
is within skb->len to avoid OOB.

Change-Id: If936272a1b57c9239d4817e99d8bebdbc120fd20
CRs-Fixed: 2368165
Alok Kumar преди 6 години
родител
ревизия
3e9c713f2e
променени са 1 файла, в които са добавени 5 реда и са изтрити 0 реда
  1. 5 0
      core/hdd/src/wlan_hdd_tx_rx.c

+ 5 - 0
core/hdd/src/wlan_hdd_tx_rx.c

@@ -652,6 +652,11 @@ static bool hdd_tx_rx_is_dns_domain_name_match(struct sk_buff *skb,
 	if (adapter->track_dns_domain_len == 0)
 		return false;
 
+	/* check OOB , is strncmp accessing data more than skb->len */
+	if ((adapter->track_dns_domain_len +
+	    QDF_NBUF_PKT_DNS_NAME_OVER_UDP_OFFSET) > qdf_nbuf_len(skb))
+		return false;
+
 	domain_name = qdf_nbuf_get_dns_domain_name(skb,
 						adapter->track_dns_domain_len);
 	if (strncmp(domain_name, adapter->dns_payload,