rubenslte/android_kernel_samsung_msm8226-rubenslte
1
Fork 0
forked from rubenslte/android_kernel_samsung_msm8226
Code Pull Requests Activity

wlan: Validate assoc response IE len before copy

Browse Source 
When host sends assoc response to supplicant, it
allocates a buffer of fixed size and copies a variable
length of assoc response IEs to this fixed sized buffer.
There is a possibility of OOB write to the allocated buffer
if the assoc response IEs length is greater than the
allocated buffer size.
To avoid above issue validate the assoc response IEs length
with the allocated buffer size before data copy to the buffer.

Change-Id: Ib12385e9ff04e5172ae8b505faf959e426fda439
CRs-Fixed: 2616226
(cherry picked from commit 9bb1a72f6ebdf5d2b1a466aec732aa9c5bc37c4d)
This commit is contained in:
Ashish Kumar Dhanotiya
2021-10-10 23:46:47 +02:00
committed by Francescodario Cuzzocrea
parent 714434efb8
commit 5e0789d479
1 changed files with 9 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/staging/prima/CORE/HDD/src/wlan_hdd_assoc.c
+9 -2
View File
@@ -1484,8 +1484,10 @@ static void hdd_SendReAssocEvent(struct net_device *dev, hdd_adapter_t *pAdapter
goto done;
}
if (pCsrRoamInfo->nAssocRspLength == 0) {
hddLog(LOGE, "%s: Invalid assoc response length", __func__);
if (pCsrRoamInfo->nAssocRspLength < FT_ASSOC_RSP_IES_OFFSET) {
hddLog(LOGE, "%s: Invalid assoc response length %d",
__func__, pCsrRoamInfo->nAssocRspLength);
goto done;
}
@@ -1502,6 +1504,11 @@ static void hdd_SendReAssocEvent(struct net_device *dev, hdd_adapter_t *pAdapter
// Send the Assoc Resp, the supplicant needs this for initial Auth.
len = pCsrRoamInfo->nAssocRspLength - FT_ASSOC_RSP_IES_OFFSET;
if (len > IW_GENERIC_IE_MAX) {
hddLog(LOGE, "%s: Invalid assoc response length %d",
__func__, pCsrRoamInfo->nAssocRspLength);
goto done;
}
rspRsnLength = len;
memcpy(rspRsnIe, pFTAssocRsp, len);
memset(rspRsnIe + len, 0, IW_GENERIC_IE_MAX - len);