From 6347c8aaa2d5d214b2132ce60b7663ec994d4d50 Mon Sep 17 00:00:00 2001
From: hqu <hqu@codeaurora.org>
Date: Wed, 27 Feb 2019 16:28:52 +0800
Subject: [PATCH] qcacld-2.0: Fix possible OOB in limProcessAssocReqFrame

propagation from qcacld-3.0 to qcacld-2.0

In the function limProcessAssocReqFrame, if wpa IE is
present, then dot11fUnpackIeWPA is called to copy the wpa IE
to destination buffer. pAssocReq->wpa.length is passed as the
length to copy the IE. As this length includes 4 bytes of the
OUI fields also, this could result in OOB read.

Change the length passed to the dot11fUnpackIeWPA as
(pAssocReq->wpa.length - 4), so that the additional 4 bytes of
the OUI fields are excluded.

Change-Id: If972b3a19d239bb955c7b4d4c7d94e25aa878f21
CRs-Fixed: 2406159
---
 .../staging/prima/CORE/MAC/src/pe/lim/limAssocUtils.c  | 10 +++++-----
 .../CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c      |  4 ++--
 2 files changed, 7 insertions(+), 7 deletions(-)

diff --git a/drivers/staging/prima/CORE/MAC/src/pe/lim/limAssocUtils.c b/drivers/staging/prima/CORE/MAC/src/pe/lim/limAssocUtils.c
index e9b59c8fcdd..787d1b1a9e7 100644
--- a/drivers/staging/prima/CORE/MAC/src/pe/lim/limAssocUtils.c
+++ b/drivers/staging/prima/CORE/MAC/src/pe/lim/limAssocUtils.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2011-2015 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2011-2019 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -436,8 +436,8 @@ limCheckMCSSet(tpAniSirGlobal pMac, tANI_U8* supportedMCSSet)
  *
  * @param  rxRSNIe - received RSN IE in (Re)Assco req
  *
- * @return status - true if ALL BSS basic rates are present in the
- *                  received rateset else false.
+ * @return status - true if ALL supported cipher suites are present in the
+ *                  received rsn IE else false.
  */
 
 tANI_U8
@@ -563,8 +563,8 @@ limCheckRxRSNIeMatch(tpAniSirGlobal pMac, tDot11fIERSN rxRSNIe,tpPESession pSess
  *
  * @param  rxWPAIe - Received WPA IE in (Re)Assco req
  *
- * @return status - true if ALL BSS basic rates are present in the
- *                  received rateset else false.
+ * @return status - true if ALL supported cipher suites are present in the
+ *                  received wpa IE else false.
  */
 
 tANI_U8
diff --git a/drivers/staging/prima/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c b/drivers/staging/prima/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c
index 6ba86ca77dc..44c4cce9cf2 100644
--- a/drivers/staging/prima/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c
+++ b/drivers/staging/prima/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 2012-2013 The Linux Foundation. All rights reserved.
+ * Copyright (c) 2012-2019 The Linux Foundation. All rights reserved.
  *
  * Previously licensed under the ISC license by Qualcomm Atheros, Inc.
  *
@@ -781,7 +781,7 @@ limProcessAssocReqFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo,
                 {
                     if (dot11fUnpackIeWPA(pMac,
                                         &pAssocReq->wpa.info[4], //OUI is not taken care
-                                        pAssocReq->wpa.length, 
+                                        (pAssocReq->wpa.length - 4),
                                         &Dot11fIEWPA) != DOT11F_PARSE_SUCCESS)
                     {
                         limLog(pMac, LOGE, FL("Invalid WPA IE"));