Преглед изворни кода

qcacld-3.0: Resolve out of bound memory access while processing VSIEs

Currently elem_len is not checked against WPS_OUI_TYPE_SIZE
before it uses the buffer for memcmp, this may cause the buffer
overread.

To fix this add the proper comparision logic before the API uses
the buffer.

Change-Id: I9ba63543a529fb88932500be39045fcc19509863
CRs-Fixed: 2061159
Ashish Kumar Dhanotiya пре 7 година
родитељ
комит
ff252beffa
1 измењених фајлова са 1 додато и 1 уклоњено
  1. 1 1
      core/hdd/src/wlan_hdd_hostapd.c

+ 1 - 1
core/hdd/src/wlan_hdd_hostapd.c

@@ -6688,7 +6688,7 @@ static void wlan_hdd_add_hostapd_conf_vsie(hdd_adapter_t *pHostapdAdapter,
 		elem_id = ptr[0];
 		elem_len = ptr[1];
 		left -= 2;
-		if (elem_len > left) {
+		if (elem_len > left || elem_len < WPS_OUI_TYPE_SIZE) {
 			hdd_err("**Invalid IEs eid: %d elem_len: %d left: %d**",
 				elem_id, elem_len, left);
 			return;