diff options
| author | Deeksha Gupta <deegupta@codeaurora.org> | 2021-09-29 13:38:44 +0530 |
|---|---|---|
| committer | Deeksha Gupta <deegupta@codeaurora.org> | 2021-10-05 14:48:06 +0530 |
| commit | a00610418b37ca256ace4e6394f56588e3121638 (patch) | |
| tree | b2a400d8ebd4e2d0360024f11781d06d8565858b /kernel/bpf/arraymap.c | |
| parent | 686def1e072d577c573182e43e50391ed1830cb5 (diff) | |
qcacld-3.0: Fix possible OOB in unpack_tlv_core
Currently in unpack_tlv_core(), nBufRemaining is validated
after calling framesntohs API. Since, framesntohs() copies
pIn address to pOut address with length = 2 bytes as below.
DOT11F_MEMCPY(pCtx, (uint16_t *)pOut, pIn, 2);
which could cause OOB issue if pIn contains less than 2 bytes.
Fix is to validate the nBufRemaining size before calling
framesntohs().
Change-Id: I3ead03ec948282a410ddba5b01f82ca31d3d9199
CRs-Fixed: 3042282
Diffstat (limited to 'kernel/bpf/arraymap.c')
0 files changed, 0 insertions, 0 deletions