Explorar el Código

qcacmn: Allocate mmie mic of size 16

Issue: On receiving robust bcast mgmt frames, for mmie
mic validation, mic of length 8 could be allocated.
The encrypt function however, always writes mic of length
16 resulting in memory corruption issue.

Fix: Allocate mic of size 16 for wlan_crypto_is_mmie_valid().
This is also corresponding to mic buffer size of 16 in
wlan_crypto_add_mmie().

Change-Id: I870251c0ed4224a7a974dad86f2808af7148be95
CRs-Fixed: 3091165
Disha Das hace 3 años
padre
commit
d162a849f1
Se han modificado 1 ficheros con 2 adiciones y 1 borrados
  1. 2 1
      umac/cmn_services/crypto/src/wlan_crypto_global_api.c

+ 2 - 1
umac/cmn_services/crypto/src/wlan_crypto_global_api.c

@@ -2319,6 +2319,7 @@ uint8_t *wlan_crypto_add_mmie(struct wlan_objmgr_vdev *vdev,
 	return bfrm + len;
 }
 
+#define MAX_MIC_LEN 16
 /**
  * wlan_crypto_is_mmie_valid - called by mgmt txrx to check mmie of the frame
  * @vdev: vdev
@@ -2425,7 +2426,7 @@ bool wlan_crypto_is_mmie_valid(struct wlan_objmgr_vdev *vdev,
 	 */
 	qdf_mem_copy(buf + 20, frm + hdrlen, len - hdrlen);
 	qdf_mem_zero(buf + (len - hdrlen + 20 - mic_len), mic_len);
-	mic = qdf_mem_malloc(mic_len);
+	mic = qdf_mem_malloc(MAX_MIC_LEN);
 	if (!mic) {
 		qdf_mem_free(buf);
 		return false;