From 4ecd853b716c3ecc6d5a5024c05849688733e1a6 Mon Sep 17 00:00:00 2001 From: Sourav Mohapatra Date: Tue, 31 Mar 2020 10:47:10 +0530 Subject: [PATCH] wlan: Add sanity check for data in ptt_sock_rx_nlink_msg Currently in the driver, while typecasting the skb data to local structure in function ptt_sock_proc_reg_req, there can occur a potential OOB read. The length of the data to be typecasted is not verified properly. Add a sanity check to verify that the data being typecasted is of proper size. Change-Id: Ib88477a2817649e092e25e21f948c33160dfa09b CRs-Fixed: 2559499 --- drivers/staging/prima/CORE/SVC/src/ptt/wlan_ptt_sock_svc.c | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/drivers/staging/prima/CORE/SVC/src/ptt/wlan_ptt_sock_svc.c b/drivers/staging/prima/CORE/SVC/src/ptt/wlan_ptt_sock_svc.c index 465426e4395..04d41d3e7d7 100644 --- a/drivers/staging/prima/CORE/SVC/src/ptt/wlan_ptt_sock_svc.c +++ b/drivers/staging/prima/CORE/SVC/src/ptt/wlan_ptt_sock_svc.c @@ -293,6 +293,11 @@ static int ptt_sock_rx_nlink_msg (struct sk_buff * skb) wnl = (tAniNlHdr *) skb->data; radio = wnl->radio; type = wnl->nlh.nlmsg_type; + + if (wnl->nlh.nlmsg_len < (sizeof(struct nlmsghdr) + + sizeof(int) + sizeof(tAniHdr) + wnl->wmsg.length)) + return -EINVAL; + switch (type) { case ANI_NL_MSG_PUMAC: //Message from the PTT socket APP PTT_TRACE(VOS_TRACE_LEVEL_INFO, "%s: Received ANI_NL_MSG_PUMAC Msg [0x%X]\n",