Browse Source

qcacld-3.0: Fix OOB access in MLIE parsing

In sir_convert_beacon_frame2_mlo_struct, not validating the return
status of util_get_bvmlie_persta_partner_info, even though validating
the IE data in this API but for the bad IE also storing the data.
This will cause OOB access while storing the data if the IE is malformed.

Fix to check the return value in util_get_bvmlie_persta_partner_info,
if the return value is error don't access and store the data.

Change-Id: I5605aeaafcaf9fc2de3e74d06ae64ac9f05837fe
CRs-Fixed: 3581068
Vinod Kumar Myadam 1 year ago
parent
commit
ea91bcc73d
1 changed files with 6 additions and 3 deletions
  1. 6 3
      core/mac/src/sys/legacy/src/utils/src/parser_api.c

+ 6 - 3
core/mac/src/sys/legacy/src/utils/src/parser_api.c

@@ -5289,9 +5289,12 @@ sir_convert_beacon_frame2_mlo_struct(uint8_t *pframe, uint32_t nframe,
 					nframe - WLAN_BEACON_IES_OFFSET,
 					&ml_ie, &ml_ie_total_len);
 		if (QDF_IS_STATUS_SUCCESS(status)) {
-			util_get_bvmlie_persta_partner_info(ml_ie,
-							    ml_ie_total_len,
-							    &partner_info);
+			status = util_get_bvmlie_persta_partner_info(
+								ml_ie,
+								ml_ie_total_len,
+								&partner_info);
+			if (QDF_IS_STATUS_ERROR(status))
+				return status;
 			bcn_struct->mlo_ie.mlo_ie.num_sta_profile =
 						partner_info.num_partner_links;
 			util_get_mlie_common_info_len(ml_ie, ml_ie_total_len,