rubenslte/android_kernel_samsung_msm8226-rubenslte
1
Fork 0
forked from rubenslte/android_kernel_samsung_msm8226
Code Pull Requests Activity

prima: Validate pkt buffer size.

Browse Source 
In function parse_Bufferforpkt, pkt data index is not validated.
This may lead to a buffer overflow if the incoming buffer is too large.

Validate packet buffer length with the total allowed pkt buffer size.

Change-Id: I9b9ffa592cbe3a0d87af3cbbef3608bc59e01cfc
CRs-Fixed: 1092599
This commit is contained in:
Sachin Ahuja
2020-05-21 10:53:53 +02:00
committed by Francescodario Cuzzocrea
parent 295030a4c5
commit 90996a04c7
1 changed files with 3 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
drivers/staging/prima/CORE/HDD/src/wlan_hdd_wext.c
+3
View File
@@ -3859,6 +3859,9 @@ static void parse_Bufferforpkt(tSirpkt80211 *pkt, u8 *pBuffer, u16 len)
length += getByte(&temp) << 8;
hddLog(VOS_TRACE_LEVEL_INFO,"Payload length : %d", length);
if (length >= WLAN_DISA_MAX_PAYLOAD_SIZE)
length = WLAN_DISA_MAX_PAYLOAD_SIZE;
pkt->data.length = length;
for (i = 0; i< length; i++) {