From b5fd7c5da01445cee10cccd706868a69b4f18c68 Mon Sep 17 00:00:00 2001 From: Jeff Johnson Date: Fri, 11 Nov 2016 17:37:54 -0800 Subject: qcacld-3.0: Avoid overflow of EPNO network list This is a qcacld-2.0 to qcacld-3.0 propagation. Currently when processing an EPNO vendor command the "num networks" attribute is limit checked and if it exceeds a MAX value then it is reset to that MAX value. This value is then used to calculate the size of the buffer allocated to hold the internal representation of the request. However later when the network attributes are parsed there is no check to make sure the number of networks processed does not exceed the (possibly modified) "num networks" used to allocate memory, and as a result a buffer overflow can occur. Address this issue by aborting the network parsing once "num networks" records have been parsed. Change-Id: I6e5f321d23471d082bb000ad0422ea9baa76577a CRs-Fixed: 1087807 --- core/hdd/src/wlan_hdd_ext_scan.c | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/core/hdd/src/wlan_hdd_ext_scan.c b/core/hdd/src/wlan_hdd_ext_scan.c index defad2bc96c8..570567005e15 100644 --- a/core/hdd/src/wlan_hdd_ext_scan.c +++ b/core/hdd/src/wlan_hdd_ext_scan.c @@ -3770,11 +3770,19 @@ static int hdd_extscan_epno_fill_network_list( struct nlattr *networks; int rem1, ssid_len; uint8_t index, *ssid; + uint32_t expected_networks; + expected_networks = req_msg->num_networks; index = 0; nla_for_each_nested(networks, tb[QCA_WLAN_VENDOR_ATTR_PNO_SET_LIST_PARAM_EPNO_NETWORKS_LIST], rem1) { + + if (index == expected_networks) { + hdd_warn("ignoring excess networks"); + break; + } + if (nla_parse(network, QCA_WLAN_VENDOR_ATTR_PNO_MAX, nla_data(networks), nla_len(networks), wlan_hdd_pno_config_policy)) { @@ -3829,6 +3837,7 @@ static int hdd_extscan_epno_fill_network_list( index++; } + req_msg->num_networks = index; return 0; } -- cgit v1.2.3