From 7e82edc9f1ed60fa99dd4da29f91c4ad79470d7e Mon Sep 17 00:00:00 2001 From: Hong Shi Date: Sun, 3 Dec 2017 21:36:59 +0800 Subject: qcacld-2.0: Fix buffer overread in lim_process_fils_auth_frame2 The return value validation is missing for dot11fUnpackIeRSN, thus "dot11f_ie_rsn.pmkid_count" could be larger than 4. When it is larger than 4 there will be a buffer over-read in vos_mem_compare. Add status check of dot11fUnpackIeRSN in lim_process_fils_auth_frame2. Change-Id: If563ddb13bbfcad5660d136c35c39846010594e1 CRs-Fixed: 2147955 --- CORE/MAC/src/pe/lim/lim_process_fils.c | 7 +++++-- 1 file changed, 5 insertions(+), 2 deletions(-) diff --git a/CORE/MAC/src/pe/lim/lim_process_fils.c b/CORE/MAC/src/pe/lim/lim_process_fils.c index 455bcee725de..5ab7e27bab0d 100644 --- a/CORE/MAC/src/pe/lim/lim_process_fils.c +++ b/CORE/MAC/src/pe/lim/lim_process_fils.c @@ -1132,10 +1132,13 @@ bool lim_process_fils_auth_frame2(tpAniSirGlobal mac_ctx, if (!pe_session->fils_info) return false; - dot11fUnpackIeRSN(mac_ctx, + + if (dot11fUnpackIeRSN(mac_ctx, &rx_auth_frm_body->rsn_ie.info[0], rx_auth_frm_body->rsn_ie.length, - &dot11f_ie_rsn); + &dot11f_ie_rsn) != DOT11F_PARSE_SUCCESS) { + return false; + } for (i = 0; i < dot11f_ie_rsn.pmkid_count; i++) { if (vos_mem_compare(dot11f_ie_rsn.pmkid[i], -- cgit v1.2.3