소스 검색

qcacld-3.0: Fix OOB access in MLIE parsing

In sir_convert_beacon_frame2_mlo_struct, not validating the return
status of util_get_bvmlie_persta_partner_info, even though validating
the IE data in this API but for the bad IE also storing the data.
This will cause OOB access while storing the data if the IE is malformed.

Fix to check the return value in util_get_bvmlie_persta_partner_info,
if the return value is error don't access and store the data.

Change-Id: I5605aeaafcaf9fc2de3e74d06ae64ac9f05837fe
CRs-Fixed: 3581068
Vinod Kumar Myadam 1 년 전
부모
커밋
ea91bcc73d
1개의 변경된 파일6개의 추가작업 그리고 3개의 파일을 삭제
  1. 6 3
      core/mac/src/sys/legacy/src/utils/src/parser_api.c

+ 6 - 3
core/mac/src/sys/legacy/src/utils/src/parser_api.c

@@ -5289,9 +5289,12 @@ sir_convert_beacon_frame2_mlo_struct(uint8_t *pframe, uint32_t nframe,
 					nframe - WLAN_BEACON_IES_OFFSET,
 					&ml_ie, &ml_ie_total_len);
 		if (QDF_IS_STATUS_SUCCESS(status)) {
-			util_get_bvmlie_persta_partner_info(ml_ie,
-							    ml_ie_total_len,
-							    &partner_info);
+			status = util_get_bvmlie_persta_partner_info(
+								ml_ie,
+								ml_ie_total_len,
+								&partner_info);
+			if (QDF_IS_STATUS_ERROR(status))
+				return status;
 			bcn_struct->mlo_ie.mlo_ie.num_sta_profile =
 						partner_info.num_partner_links;
 			util_get_mlie_common_info_len(ml_ie, ml_ie_total_len,