samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacld-3.0: Fix potential OOB read in lim_parse_kde_elements

Browse Source 
In function lim_parse_kde_elements, while parsing the KDE list from
the assoc response frame, elem_len is obtained from the frame buffer.
elem_len is then used to find the matching OUI for KDE OUI type and
then to calculate data_len based on the offset for the GTK/IGTK data
types.

If the value in elem_len field in the frame is less than the Data
Offset (which includes the OUI and data type) or the GTK/IGTK offset
then a OOB read would occur.

Add checks to validate the elem_len with Data offset and then with
the GTK/IGTK offset based on the data type.

Change-Id: I8ae31c6d6c28e88ad9bda757b3f1ff2585f8a553
CRs-Fixed: 2161920
This commit is contained in:
Vignesh Viswanathan
2017-12-20 19:58:58 +05:30
committed by snandini
parent 9c8e7e6222
commit 59bf3d4bf0
1 changed files with 16 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
core/mac/src/pe/lim/lim_process_fils.c
View File

@@ -1353,6 +1353,12 @@ static QDF_STATUS lim_parse_kde_elements(tpAniSirGlobal mac_ctx,
return QDF_STATUS_E_FAILURE;
}
if (elem_len < KDE_IE_DATA_OFFSET) {
pe_err("Not enough len to parse elem_len %d",
elem_len);
return QDF_STATUS_E_FAILURE;
}
if (lim_check_if_vendor_oui_match(mac_ctx, KDE_OUI_TYPE,
KDE_OUI_TYPE_SIZE, current_ie, elem_len)) {
@@ -1362,6 +1368,11 @@ static QDF_STATUS lim_parse_kde_elements(tpAniSirGlobal mac_ctx,
switch (data_type) {
case DATA_TYPE_GTK:
if (data_len < GTK_OFFSET) {
pe_err("Invalid KDE data_len %d",
data_len);
return QDF_STATUS_E_FAILURE;
}
qdf_mem_copy(fils_info->gtk, (ie_data +
GTK_OFFSET), (data_len -
GTK_OFFSET));
@@ -1369,6 +1380,11 @@ static QDF_STATUS lim_parse_kde_elements(tpAniSirGlobal mac_ctx,
break;
case DATA_TYPE_IGTK:
if (data_len < IGTK_OFFSET) {
pe_err("Invalid KDE data_len %d",
data_len);
return QDF_STATUS_E_FAILURE;
}
fils_info->igtk_len = (data_len - IGTK_OFFSET);
qdf_mem_copy(fils_info->igtk, (ie_data +
IGTK_OFFSET), (data_len -