Эх сурвалжийг харах

qcacld-3.0: Drop assoc request if RSNIE/WPAIE parsing fail

Add changes to drop assoc request and return error if RSNIE or
WPAIE parsing fail during parsing of assoc request.

CRs-Fixed: 2046578
Change-Id: I88d779399c2eba5d33c30144bf9600a1f3a00b77
Kapil Gupta 8 жил өмнө
parent
commit
9890619d29

+ 12 - 4
core/mac/src/pe/lim/lim_process_assoc_req_frame.c

@@ -776,10 +776,14 @@ static bool lim_chk_n_process_wpa_rsn_ie(tpAniSirGlobal mac_ctx,
 			if (assoc_req->rsnPresent) {
 				if (assoc_req->rsn.length) {
 					/* Unpack the RSN IE */
-					dot11f_unpack_ie_rsn(mac_ctx,
+					if (dot11f_unpack_ie_rsn(mac_ctx,
 						&assoc_req->rsn.info[0],
 						assoc_req->rsn.length,
-						&dot11f_ie_rsn, false);
+						&dot11f_ie_rsn, false) !=
+							DOT11F_PARSE_SUCCESS) {
+						pe_err("Invalid RSN ie");
+						return false;
+					}
 
 					/* Check RSN version is supported */
 					if (SIR_MAC_OUI_VERSION_1 ==
@@ -847,10 +851,14 @@ static bool lim_chk_n_process_wpa_rsn_ie(tpAniSirGlobal mac_ctx,
 				/* Unpack the WPA IE */
 				if (assoc_req->wpa.length) {
 					/* OUI is not taken care */
-					dot11f_unpack_ie_wpa(mac_ctx,
+					if (dot11f_unpack_ie_wpa(mac_ctx,
 						&assoc_req->wpa.info[4],
 						assoc_req->wpa.length,
-						&dot11f_ie_wpa, false);
+						&dot11f_ie_wpa, false) !=
+							DOT11F_PARSE_SUCCESS) {
+						pe_err("Invalid WPA IE");
+						return false;
+					}
 					/*
 					 * check the groupwise and pairwise
 					 * cipher suites