rubenslte/android_kernel_samsung_msm8226-rubenslte
1
Fork 0
forked from rubenslte/android_kernel_samsung_msm8226
Code Pull Requests Activity

wlan: Avoid int overflow in csr_scan_save_preferred_network_found()

Browse Source 
Add validation check on frameLength to avoid int overflow in
csr_scan_save_preferred_network_found function.

Change-Id: I6bcdfb757610152bc801d5134e62dd58629d1e81
CRs-Fixed: 2232358
Signed-off-by: Gururaj Patil <gururaj.patil3@harman.com>
This commit is contained in:
Gururaj Patil
2021-10-10 23:46:47 +02:00
committed by Francescodario Cuzzocrea
parent 3edcf16d05
commit 62e33cb8bb
1 changed files with 7 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/staging/prima/CORE/SME/src/csr/csrApiScan.c
+7
View File
@@ -8435,6 +8435,13 @@ eHalStatus csrScanSavePreferredNetworkFound(tpAniSirGlobal pMac,
uLen = pPrefNetworkFoundInd->frameLength -
(SIR_MAC_HDR_LEN_3A + SIR_MAC_B_PR_SSID_OFFSET);
}
if (uLen > (UINT_MAX - sizeof(tCsrScanResult))) {
smsLog(pMac, LOGE,
FL("Incorrect len: %d, may leads to int overflow, uLen %d"),
pPrefNetworkFoundInd->frameLength, uLen);
vos_mem_vfree(pParsedFrame);
return eHAL_STATUS_FAILURE;
}
if (uLen > (UINT_MAX - sizeof(tCsrScanResult))) {
smsLog(pMac, LOGE, FL("Incorrect len: %d, may leads to int overflow, uLen %d"),