samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacld-3.0: Fix possible heap overflow in lim_update_ext_cap_ie

Browse Source 
In the function lim_process_set_default_scan_ie_request, memory
of MAX_DEFAULT_SCAN_IE_LEN (2048) is allocated for local_ie_buf.
This local_ie_buf accommodates the ie data and also the ext
capabilities. If the local_ie_len, that is used to copy the
ie_data to local_ie_buf is greater than
MAX_DEFAULT_SCAN_IE_LEN(2048) - (DOT11F_IE_EXTCAP_MAX_LEN(15) +
EXT_CAP_IE_HDR_LEN(2)), then heap overflow could occur.

Validate the MAX_DEFAULT_SCAN_IE_LEN against the difference
between MAX_DEFAULT_SCAN_IE_LEN and sum of EXT_CAP_IE_HDR_LEN
and DOT11F_IE_EXTCAP_MAX_LEN.

Change-Id: Id2f950440d69ddb09090643f8a426061c0d336c3
CRs-Fixed: 2231300
This commit is contained in:
Pragaspathi Thilagaraj
2018-06-25 18:37:05 +05:30
committed by nshrivas
parent 2650d4eb6e
commit 6cf025f727
1 changed files with 16 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

16
core/mac/src/pe/lim/lim_api.c
View File

@@ -2788,6 +2788,10 @@ QDF_STATUS lim_update_ext_cap_ie(tpAniSirGlobal mac_ctx,
return QDF_STATUS_E_FAILURE; return QDF_STATUS_E_FAILURE;
} }
if ((*local_ie_len) > (MAX_DEFAULT_SCAN_IE_LEN - EXT_CAP_IE_HDR_LEN)) {
pe_err("Invalid Scan IE length");
return QDF_STATUS_E_FAILURE;
}
/* copy ie prior to ext cap to local buffer */ /* copy ie prior to ext cap to local buffer */
qdf_mem_copy(local_ie_buf, ie_data, (*local_ie_len)); qdf_mem_copy(local_ie_buf, ie_data, (*local_ie_len));
@@ -2804,6 +2808,12 @@ QDF_STATUS lim_update_ext_cap_ie(tpAniSirGlobal mac_ctx,
pe_err("Failed %d to create ext cap IE. Use default value instead", pe_err("Failed %d to create ext cap IE. Use default value instead",
status); status);
local_ie_buf[*local_ie_len + 1] = DOT11F_IE_EXTCAP_MAX_LEN; local_ie_buf[*local_ie_len + 1] = DOT11F_IE_EXTCAP_MAX_LEN;
if ((*local_ie_len) > (MAX_DEFAULT_SCAN_IE_LEN -
(DOT11F_IE_EXTCAP_MAX_LEN + EXT_CAP_IE_HDR_LEN))) {
pe_err("Invalid Scan IE length");
return QDF_STATUS_E_FAILURE;
}
(*local_ie_len) += EXT_CAP_IE_HDR_LEN; (*local_ie_len) += EXT_CAP_IE_HDR_LEN;
qdf_mem_copy(local_ie_buf + (*local_ie_len), qdf_mem_copy(local_ie_buf + (*local_ie_len),
default_scan_ext_cap.bytes, default_scan_ext_cap.bytes,
@@ -2813,6 +2823,12 @@ QDF_STATUS lim_update_ext_cap_ie(tpAniSirGlobal mac_ctx,
} }
lim_merge_extcap_struct(&driver_ext_cap, &default_scan_ext_cap, true); lim_merge_extcap_struct(&driver_ext_cap, &default_scan_ext_cap, true);
local_ie_buf[*local_ie_len + 1] = driver_ext_cap.num_bytes; local_ie_buf[*local_ie_len + 1] = driver_ext_cap.num_bytes;
if ((*local_ie_len) > (MAX_DEFAULT_SCAN_IE_LEN -
(EXT_CAP_IE_HDR_LEN + driver_ext_cap.num_bytes))) {
pe_err("Invalid Scan IE length");
return QDF_STATUS_E_FAILURE;
}
(*local_ie_len) += EXT_CAP_IE_HDR_LEN; (*local_ie_len) += EXT_CAP_IE_HDR_LEN;
qdf_mem_copy(local_ie_buf + (*local_ie_len), qdf_mem_copy(local_ie_buf + (*local_ie_len),
driver_ext_cap.bytes, driver_ext_cap.num_bytes); driver_ext_cap.bytes, driver_ext_cap.num_bytes);