samsung-sm8650/android_kernel_samsung_sm8650-modules
1
0
Fork 0
Koodi Ongelmat Pull-pyynnöt Actions Paketit Projektit Julkaisut Wiki Toiminta

qcacmn: Fix OOB issue in wlan_parse_rsn_ie

Selaa lähdekoodia 
Issue: Currently, host doesn't validate pkid_count
before populating data in rsn->pmkid. rsn->pmkid array
can store only 4/MAX_PMKID pmkids which may cause OOB
write if host tries to copy pmkids more than MAX_PMKID.

Fix: validate pkid_count before populating rsn->pmkid
and return Failure in case pkid_count becomes greater
than MAX_PMKID to avoid OOB.

Change-Id: I211ea791a52ecb84872d139929f999a89db240d5
CRs-Fixed: 2724407
This commit is contained in:
sheenam monga
2020-07-08 10:34:46 +05:30
committed by nshrivas
vanhempi 4b9b060974
commit fe1e85068c
1 muutettua tiedostoa jossa 2 lisäystä ja 1 poistoa
Download Patch File Download Diff File Expand all files Collapse all files

3
umac/cmn_services/cmn_defs/inc/wlan_cmn_ieee80211.h
Näytä tiedosto

@@ -1666,7 +1666,8 @@ static inline QDF_STATUS wlan_parse_rsn_ie(uint8_t *rsn_ie,
rsn->pmkid_count = LE_READ_2(ie);
ie += 2;
rem_len -= 2;
if (rsn->pmkid_count > (unsigned int) rem_len / PMKID_LEN) {
if (rsn->pmkid_count > MAX_PMKID ||
rsn->pmkid_count > (unsigned int)rem_len / PMKID_LEN) {
rsn->pmkid_count = 0;
return QDF_STATUS_E_INVAL;
}