rubenslte/android_kernel_samsung_msm8226-rubenslte
1
Fork 0
forked from rubenslte/android_kernel_samsung_msm8226
Code Pull Requests Activity

wlan: Fix integer overflow in rrm_fill_beacon_ies()

Browse Source 
In function rrm_fill_beacon_ies, the total IE length is
calculated as sum of length field of the IE and 2 (element id 1
byte and IE length field 1 byte). The total IE length is defined
of type uint16_t and will overflow if the *(pBcnIes + 1)=0xfe.
Validate the len against total IE length to avoid overflow.

Change-Id: If8f86952ce43c5923906fc6ef18705f1785c5d88
CRs-Fixed: 2617004
(cherry picked from commit 949b1745b9e1ddd8f81960723643cdf10e5f1963)
This commit is contained in:
Pragaspathi Thilagaraj
2021-10-10 23:46:47 +02:00
committed by Francescodario Cuzzocrea
parent cbd27d9917
commit 714434efb8
1 changed files with 10 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/staging/prima/CORE/MAC/src/pe/rrm/rrmApi.c
+10 -2
View File
@@ -712,7 +712,8 @@ rrmFillBeaconIes( tpAniSirGlobal pMac,
tANI_U8 *eids, tANI_U8 numEids,
tpSirBssDescription pBssDesc )
{
tANI_U8 len, *pBcnIes, BcnNumIes, count = 0, i;
tANI_U8 len, *pBcnIes, count = 0, i;
tANI_U16 BcnNumIes = 0;
if( (pIes == NULL) || (pNumIes == NULL) || (pBssDesc == NULL) )
{
@@ -739,10 +740,17 @@ rrmFillBeaconIes( tpAniSirGlobal pMac,
while ( BcnNumIes >= 2 )
{
len = *(pBcnIes + 1) + 2; //element id + length.
len = *(pBcnIes + 1); //element id + length.
len += 2;
limLog( pMac, LOG3, "EID = %d, len = %d total = %d",
*pBcnIes, *(pBcnIes+1), len );
if (BcnNumIes < len || len <= 2) {
limLog(pMac, LOGE, "RRM: Invalid IE len:%d exp_len:%d",
len, BcnNumIes);
break;
}
i = 0;
do
{