diff options
| author | Dundi Raviteja <dundi@codeaurora.org> | 2018-06-26 13:05:20 +0530 |
|---|---|---|
| committer | nshrivas <nshrivas@codeaurora.org> | 2018-07-03 12:52:18 -0700 |
| commit | e5218abb7461b5f6c3f9547716e7ee072745a1fc (patch) | |
| tree | f81d49a277f103891ae946eea165ce201aa8b01c | |
| parent | be989bc6ea42dd06f72f49924f3e6ad0011c5652 (diff) | |
qcacld-3.0: OOB read while processing extscan change results
In function wma_extscan_change_results_event_handler(), numResults
in dest_chglist is assigning as total_entries in the event, but the
memory allocated to dest_chglist is based on the numap variable,
which may cause out of buffer read in extscan indication callback
function wlan_hdd_cfg80211_extscan_signif_wifi_change_results_ind().
Also tSirWifiSignificantChange array parsing in both the functions
is not efficient which may lead to accessing unallocated memory.
To address out of buffer read, assign numap to numResults in
dest_chglist and to address accessing of unallocated memory,
parse tSirWifiSignificantChange array with efficient logic.
Change-Id: Ia0c287147e80e17de84fe6b1cb83c8e3c29a1fa0
CRs-Fixed: 2253396
| -rw-r--r-- | core/hdd/src/wlan_hdd_ext_scan.c | 8 | ||||
| -rw-r--r-- | core/wma/src/wma_scan_roam.c | 6 |
2 files changed, 10 insertions, 4 deletions
diff --git a/core/hdd/src/wlan_hdd_ext_scan.c b/core/hdd/src/wlan_hdd_ext_scan.c index 7f8b1c35ad3b..4f52f5c2ba3e 100644 --- a/core/hdd/src/wlan_hdd_ext_scan.c +++ b/core/hdd/src/wlan_hdd_ext_scan.c @@ -733,7 +733,9 @@ wlan_hdd_cfg80211_extscan_signif_wifi_change_results_ind( for (j = 0; j < ap_info->numOfRssi; j++) hdd_debug("Rssi %d", *rssi++); - ap_info += ap_info->numOfRssi * sizeof(*rssi); + ap_info = (tSirWifiSignificantChange *)((char *)ap_info + + ap_info->numOfRssi * sizeof(*rssi) + + sizeof(*ap_info)); } if (nla_put_u32(skb, @@ -779,7 +781,9 @@ wlan_hdd_cfg80211_extscan_signif_wifi_change_results_ind( nla_nest_end(skb, ap); - ap_info += ap_info->numOfRssi * sizeof(*rssi); + ap_info = (tSirWifiSignificantChange *)((char *)ap_info + + ap_info->numOfRssi * sizeof(*rssi) + + sizeof(*ap_info)); } nla_nest_end(skb, aps); diff --git a/core/wma/src/wma_scan_roam.c b/core/wma/src/wma_scan_roam.c index 798987b50b31..d29fcff4d431 100644 --- a/core/wma/src/wma_scan_roam.c +++ b/core/wma/src/wma_scan_roam.c @@ -5416,12 +5416,14 @@ int wma_extscan_change_results_event_handler(void *handle, src_rssi[count++]; } } - dest_ap += dest_ap->numOfRssi * sizeof(int32_t); + dest_ap = (tSirWifiSignificantChange *)((char *)dest_ap + + dest_ap->numOfRssi * sizeof(int32_t) + + sizeof(*dest_ap)); src_chglist++; } dest_chglist->requestId = event->request_id; dest_chglist->moreData = moredata; - dest_chglist->numResults = event->total_entries; + dest_chglist->numResults = numap; pMac->sme.pExtScanIndCb(pMac->hHdd, eSIR_EXTSCAN_SIGNIFICANT_WIFI_CHANGE_RESULTS_IND, |