Jelajahi Sumber

qcacld-3.0: Add length check in wma_update_beacon_noa_ie

It may cause out of bound access if length exceed
SIR_MAX_BEACON_SIZE.

Add length check to protect that.

Change-Id: I6581b62aa8b380a0f1195a16515ad635a9154023
CRs-Fixed: 3147267
Jingxiang Ge 3 tahun lalu
induk
melakukan
ee4a748759
1 mengubah file dengan 8 tambahan dan 0 penghapusan
  1. 8 0
      core/wma/src/wma_power.c

+ 8 - 0
core/wma/src/wma_power.c

@@ -1195,6 +1195,14 @@ static void wma_update_beacon_noa_ie(struct beacon_info *bcn,
 		bcn->noa_ie = buf + bcn->len;
 	}
 
+	if (bcn->len + sizeof(struct p2p_ie) + new_noa_sub_ie_len >
+	    SIR_MAX_BEACON_SIZE) {
+		wma_err("exceed max beacon length, bcn->len %d, new_noa_sub_ie_len %d, p2p len %u",
+			bcn->len, new_noa_sub_ie_len,
+			(uint32_t)sizeof(struct p2p_ie));
+		return;
+	}
+
 	bcn->noa_sub_ie_len = new_noa_sub_ie_len;
 	wma_add_p2p_ie(bcn->noa_ie);
 	p2p_ie = (struct p2p_ie *)bcn->noa_ie;