Преглед на файлове

qcacmn: Fix information leak issue during memcpy

The buffer allocated with length "ATH6KL_FWLOG_PAYLOAD_SIZE"
is not initialized, this may lead to information leak during
memcpy when len < ATH6KL_FWLOG_PAYLOAD_SIZE.

To resolve this issue, memset the buffer for length
(ATH6KL_FWLOG_PAYLOAD_SIZE - len) to 0

Change-Id: If4a49347d674ad2af0438b408a4a4b9308c61026
CRs-Fixed: 2255083
Alok Kumar преди 6 години
родител
ревизия
e7ac594b6a
променени са 1 файла, в които са добавени 12 реда и са изтрити 0 реда
  1. 12 0
      utils/fwlog/dbglog_host.c

+ 12 - 0
utils/fwlog/dbglog_host.c

@@ -1764,6 +1764,12 @@ send_diag_netlink_data(const uint8_t *buffer, uint32_t len, uint32_t cmd)
 		slot->dropped = get_version;
 		memcpy(slot->payload, buffer, len);
 
+		/*
+		 * Need to pad each record to fixed length
+		 * ATH6KL_FWLOG_PAYLOAD_SIZE
+		 */
+		memset(slot->payload + len, 0, ATH6KL_FWLOG_PAYLOAD_SIZE - len);
+
 		res = nl_srv_bcast_fw_logs(skb_out);
 		if ((res < 0) && (res != -ESRCH)) {
 			AR_DEBUG_PRINTF(ATH_DEBUG_RSVD1,
@@ -1824,6 +1830,12 @@ dbglog_process_netlink_data(wmi_unified_t wmi_handle, const uint8_t *buffer,
 		slot->dropped = cpu_to_le32(dropped);
 		memcpy(slot->payload, buffer, len);
 
+		/*
+		 * Need to pad each record to fixed length
+		 * ATH6KL_FWLOG_PAYLOAD_SIZE
+		 */
+		memset(slot->payload + len, 0, ATH6KL_FWLOG_PAYLOAD_SIZE - len);
+
 		res = nl_srv_bcast_fw_logs(skb_out);
 		if ((res < 0) && (res != -ESRCH)) {
 			AR_DEBUG_PRINTF(ATH_DEBUG_RSVD1,