소스 검색

qcacld-3.0: Add check to avoid OOB access

Currently while updating EAPOL stats, there is no check
for subtype greater than array size, which can result in OOB access.

To fix the issue add additional check for subtype <= EAPOL M4 to
avoid OOB access.

Change-Id: I906ce9166b7a0202335403c77dc6bcd135dea663
CRs-Fixed: 3387939
Amit Mehta 2 년 전
부모
커밋
7297c338d7
1개의 변경된 파일2개의 추가작업 그리고 1개의 파일을 삭제
  1. 2 1
      components/dp/core/src/wlan_dp_txrx.c

+ 2 - 1
components/dp/core/src/wlan_dp_txrx.c

@@ -796,7 +796,8 @@ void dp_sta_notify_tx_comp_cb(qdf_nbuf_t nbuf, void *ctx, uint16_t flag)
 	case QDF_NBUF_CB_PACKET_TYPE_EAPOL:
 	case QDF_NBUF_CB_PACKET_TYPE_EAPOL:
 		subtype = qdf_nbuf_get_eapol_subtype(nbuf);
 		subtype = qdf_nbuf_get_eapol_subtype(nbuf);
 		if (!(flag & BIT(QDF_TX_RX_STATUS_OK)) &&
 		if (!(flag & BIT(QDF_TX_RX_STATUS_OK)) &&
-		    subtype != QDF_PROTO_INVALID)
+		    subtype != QDF_PROTO_INVALID &&
+		    subtype <= QDF_PROTO_EAPOL_M4)
 			++dp_intf->dp_stats.eapol_stats.
 			++dp_intf->dp_stats.eapol_stats.
 				tx_noack_cnt[subtype - QDF_PROTO_EAPOL_M1];
 				tx_noack_cnt[subtype - QDF_PROTO_EAPOL_M1];
 		break;
 		break;