diff options
| author | gaurank kathpalia <gkathpal@codeaurora.org> | 2018-05-08 14:49:52 +0530 |
|---|---|---|
| committer | nshrivas <nshrivas@codeaurora.org> | 2018-05-15 12:54:07 -0700 |
| commit | f11cf51d09eddecc89f38e09481c302ac4cd99a5 (patch) | |
| tree | 6a3fbcefe9b7bff32ac1f4385284e24ba5d01992 | |
| parent | 770a66fbd41248a357e142d5d03cadf824b8c5a3 (diff) | |
qcacld-3.0: Remove off-by-one write condition in sch_beacon_process
In the API, the driver inserts 0 after the SSID name, to mark the
end of the ssid, but if the SSID name is 32 characters which is
the max SSID length possible, the driver puts 0 at the 33rd
place of memory which is not the part of the SSID name, which
results in OOB write, or off-by-one write condition.
Fix is to remove the addition of 0 after ssid, as in every
case the driver prints the ssid, taking the ssid length
as the input, and in that case insertion of 0 will not serve
any purpose.
Change-Id: I1d58026ec9f48fe9d00bd2f50783c65899588978
CRs-Fixed: 2232526
| -rw-r--r-- | core/mac/inc/sir_mac_prot_def.h | 4 | ||||
| -rw-r--r-- | core/mac/src/pe/sch/sch_beacon_process.c | 2 |
2 files changed, 2 insertions, 4 deletions
diff --git a/core/mac/inc/sir_mac_prot_def.h b/core/mac/inc/sir_mac_prot_def.h index 3f35924571d2..f8d35c988654 100644 --- a/core/mac/inc/sir_mac_prot_def.h +++ b/core/mac/inc/sir_mac_prot_def.h @@ -997,10 +997,10 @@ struct merged_mac_rate_set { uint8_t num_rates; uint8_t rate[2 * SIR_MAC_RATESET_EID_MAX]; }; - +/* Reserve 1 byte for NULL character in the SSID name field to print in %s */ typedef struct sSirMacSSid { uint8_t length; - uint8_t ssId[SIR_MAC_MAX_SSID_LENGTH]; + uint8_t ssId[SIR_MAC_MAX_SSID_LENGTH + 1]; } qdf_packed tSirMacSSid; typedef struct sSirMacWpaInfo { diff --git a/core/mac/src/pe/sch/sch_beacon_process.c b/core/mac/src/pe/sch/sch_beacon_process.c index 450dabd0a372..58a6e6095bb2 100644 --- a/core/mac/src/pe/sch/sch_beacon_process.c +++ b/core/mac/src/pe/sch/sch_beacon_process.c @@ -901,8 +901,6 @@ sch_beacon_process(tpAniSirGlobal mac_ctx, uint8_t *rx_pkt_info, return; } - if (bcn.ssidPresent) - bcn.ssId.ssId[bcn.ssId.length] = 0; /* * First process the beacon in the context of any existing AP or BTAP * session. This takes cares of following two scenarios: |