diff options
| author | Nachiket Kukade <nkukade@codeaurora.org> | 2017-05-12 18:53:39 +0530 |
|---|---|---|
| committer | Gerrit - the friendly Code Review server <code-review@localhost> | 2017-05-25 23:43:08 -0700 |
| commit | e4a2f7858bd50c5a7c217ca8cf9c12a85083cb17 (patch) | |
| tree | ba8881dd28b61c40e3e4afc213ae1a46da438d75 | |
| parent | 4f2d32e4734ed6239982d7af2af8c6036e3bc7c5 (diff) | |
qcacld-2.0: Add maximum bound check on WPA RSN IE length
WPA RSN IE is copied from source without a check on the given IE length.
A malicious IE length can cause buffer overflow.
Add maximum bound check on WPA RSN IE length.
Change-Id: Id159d307e8f9c1de720d4553a7c29f23cbd28571
CRs-Fixed: 2033213
| -rw-r--r-- | CORE/HDD/src/wlan_hdd_cfg80211.c | 7 |
1 files changed, 7 insertions, 0 deletions
diff --git a/CORE/HDD/src/wlan_hdd_cfg80211.c b/CORE/HDD/src/wlan_hdd_cfg80211.c index d7a4ac2e950c..9647ea9595ed 100644 --- a/CORE/HDD/src/wlan_hdd_cfg80211.c +++ b/CORE/HDD/src/wlan_hdd_cfg80211.c @@ -22162,6 +22162,13 @@ int wlan_hdd_cfg80211_set_ie(hdd_adapter_t *pAdapter, } else if (0 == memcmp(&genie[0], "\x00\x50\xf2", 3)) { + if (eLen > (MAX_WPA_RSN_IE_LEN - 2)) { + hddLog(VOS_TRACE_LEVEL_FATAL, "%s: Invalid WPA RSN IE length[%d], exceeds %d bytes", + __func__, eLen, MAX_WPA_RSN_IE_LEN - 2); + VOS_ASSERT(0); + return -EINVAL; + } + hddLog (VOS_TRACE_LEVEL_INFO, "%s Set WPA IE (len %d)",__func__, eLen + 2); memset( pWextState->WPARSNIE, 0, MAX_WPA_RSN_IE_LEN ); memcpy( pWextState->WPARSNIE, genie - 2, (eLen + 2) /*ie_len*/); |