Ver Fonte

qcacmn: Fix length check to parse non-inheritance list

Fix length check and add sub_copy and length
subie_len checks before accessing extn_elem to avoid any
OOB read.

Change-Id: I85ea636d5fe64e8508e91b06f0302d5f6258e583
CRs-Fixed: 3800831
Pooja TC há 10 meses atrás
pai
commit
dc29e1d7f3
1 ficheiros alterados com 1 adições e 1 exclusões
  1. 1 1
      umac/scan/dispatcher/src/wlan_scan_utils_api.c

+ 1 - 1
umac/scan/dispatcher/src/wlan_scan_utils_api.c

@@ -3073,7 +3073,7 @@ static uint32_t util_gen_new_ie(struct wlan_objmgr_pdev *pdev,
 
 	if (extn_elem && extn_elem[TAG_LEN_POS] >= VALID_ELEM_LEAST_LEN) {
 		if (((extn_elem + extn_elem[1] + MIN_IE_LEN) - sub_copy)
-		    < subie_len)
+		    <= subie_len)
 			util_parse_noninheritance_list(extn_elem, &elem_list,
 						       &extn_elem_list, &ninh);
 	}