From c35a47ea733c20a3758db939d92ab4c78f0c33c7 Mon Sep 17 00:00:00 2001 From: Ashish Kumar Dhanotiya Date: Mon, 23 Dec 2019 15:31:06 +0530 Subject: qcacld-3.0: Validate assoc response IE len before copy When host sends assoc response to supplicant, it allocates a buffer of fixed size and copies a variable length of assoc response IEs to this fixed sized buffer. There is a possibility of OOB write to the allocated buffer if the assoc response IEs length is greater than the allocated buffer size. To avoid above issue validate the assoc response IEs length with the allocated buffer size before data copy to the buffer. Change-ID: Ib12385e9ff04e5172ae8b505faf959e426fda439 CRs-Fixed: 2583124 --- core/hdd/src/wlan_hdd_assoc.c | 11 ++++++++--- 1 file changed, 8 insertions(+), 3 deletions(-) diff --git a/core/hdd/src/wlan_hdd_assoc.c b/core/hdd/src/wlan_hdd_assoc.c index 618b2875813a..dff5e4fec567 100644 --- a/core/hdd/src/wlan_hdd_assoc.c +++ b/core/hdd/src/wlan_hdd_assoc.c @@ -1,5 +1,5 @@ /* - * Copyright (c) 2012-2019 The Linux Foundation. All rights reserved. + * Copyright (c) 2012-2020 The Linux Foundation. All rights reserved. * * Permission to use, copy, modify, and/or distribute this software for * any purpose with or without fee is hereby granted, provided that the @@ -2258,8 +2258,9 @@ static void hdd_send_re_assoc_event(struct net_device *dev, goto done; } - if (pCsrRoamInfo->nAssocRspLength == 0) { - hdd_err("Assoc rsp length is 0"); + if (pCsrRoamInfo->nAssocRspLength < FT_ASSOC_RSP_IES_OFFSET) { + hdd_err("Invalid assoc rsp length %d", + pCsrRoamInfo->nAssocRspLength); goto done; } @@ -2289,6 +2290,10 @@ static void hdd_send_re_assoc_event(struct net_device *dev, /* Send the Assoc Resp, the supplicant needs this for initial Auth */ len = pCsrRoamInfo->nAssocRspLength - FT_ASSOC_RSP_IES_OFFSET; + if (len > IW_GENERIC_IE_MAX) { + hdd_err("Invalid Assoc resp length %d", len); + goto done; + } rspRsnLength = len; qdf_mem_copy(rspRsnIe, pFTAssocRsp, len); qdf_mem_zero(rspRsnIe + len, IW_GENERIC_IE_MAX - len); -- cgit v1.2.3 From 81794cbff1f7ff1ed130de1511e5101f94b1fc9f Mon Sep 17 00:00:00 2001 From: nshrivas Date: Wed, 12 Feb 2020 05:35:11 -0800 Subject: Release 5.1.1.76D Release 5.1.1.76D Change-Id: I105e0b69344e29c4ce26f6ff02f4264db34732d6 CRs-Fixed: 774533 --- core/mac/inc/qwlan_version.h | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/core/mac/inc/qwlan_version.h b/core/mac/inc/qwlan_version.h index b42e20c62967..4f6f782c30b8 100644 --- a/core/mac/inc/qwlan_version.h +++ b/core/mac/inc/qwlan_version.h @@ -32,9 +32,9 @@ #define QWLAN_VERSION_MAJOR 5 #define QWLAN_VERSION_MINOR 1 #define QWLAN_VERSION_PATCH 1 -#define QWLAN_VERSION_EXTRA "C" +#define QWLAN_VERSION_EXTRA "D" #define QWLAN_VERSION_BUILD 76 -#define QWLAN_VERSIONSTR "5.1.1.76C" +#define QWLAN_VERSIONSTR "5.1.1.76D" #endif /* QWLAN_VERSION_H */ -- cgit v1.2.3