Jelajahi Sumber

qcacld-3.0: Fix OOB access in MLIE parsing

In sir_convert_beacon_frame2_mlo_struct, not validating the return
status of util_get_bvmlie_persta_partner_info, even though validating
the IE data in this API but for the bad IE also storing the data.
This will cause OOB access while storing the data if the IE is malformed.

Fix to check the return value in util_get_bvmlie_persta_partner_info,
if the return value is error don't access and store the data.

Change-Id: I5605aeaafcaf9fc2de3e74d06ae64ac9f05837fe
CRs-Fixed: 3581068
Vinod Kumar Myadam 1 tahun lalu
induk
melakukan
ea91bcc73d
1 mengubah file dengan 6 tambahan dan 3 penghapusan
  1. 6 3
      core/mac/src/sys/legacy/src/utils/src/parser_api.c

+ 6 - 3
core/mac/src/sys/legacy/src/utils/src/parser_api.c

@@ -5289,9 +5289,12 @@ sir_convert_beacon_frame2_mlo_struct(uint8_t *pframe, uint32_t nframe,
 					nframe - WLAN_BEACON_IES_OFFSET,
 					&ml_ie, &ml_ie_total_len);
 		if (QDF_IS_STATUS_SUCCESS(status)) {
-			util_get_bvmlie_persta_partner_info(ml_ie,
-							    ml_ie_total_len,
-							    &partner_info);
+			status = util_get_bvmlie_persta_partner_info(
+								ml_ie,
+								ml_ie_total_len,
+								&partner_info);
+			if (QDF_IS_STATUS_ERROR(status))
+				return status;
 			bcn_struct->mlo_ie.mlo_ie.num_sta_profile =
 						partner_info.num_partner_links;
 			util_get_mlie_common_info_len(ml_ie, ml_ie_total_len,