Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Commit 474c7a7a authored by Johannes Berg's avatar Johannes Berg Committed by Lee Jones
Browse files

UPSTREAM: wifi: cfg80211: ensure length byte is present before access 



When iterating the elements here, ensure the length byte is
present before checking it to see if the entire element will
fit into the buffer.

Longer term, we should rewrite this code using the type-safe
element iteration macros that check all of this.

Bug: 254441685
Fixes: 0b8fb8235be8 ("cfg80211: Parsing of Multiple BSSID information in scanning")
Reported-by: default avatarSoenke Huster <shuster@seemoo.tu-darmstadt.de>
Signed-off-by: default avatarJohannes Berg <johannes.berg@intel.com>
(cherry picked from commit 567e14e39e8f8c6997a1378bc3be615afca86063)
Signed-off-by: default avatarLee Jones <joneslee@google.com>
Change-Id: I77f36f91888b7841fe6f701cf4e84165b4d20517
parent 0e29f851

net/wireless/scan.c

+4 −2
Original line number Diff line number Diff line
@@ -210,7 +210,8 @@ static size_t cfg80211_gen_new_ie(const u8 *ie, size_t ielen, 
	tmp_old = cfg80211_find_ie(WLAN_EID_SSID, ie, ielen);

	tmp_old = (tmp_old) ? tmp_old + tmp_old[1] + 2 : ie;



	while (tmp_old + tmp_old[1] + 2 - ie <= ielen) {

	while (tmp_old + 2 - ie <= ielen &&

	       tmp_old + tmp_old[1] + 2 - ie <= ielen) {

		if (tmp_old[0] == 0) {

			tmp_old++;

			continue;
@@ -260,7 +261,8 @@ static size_t cfg80211_gen_new_ie(const u8 *ie, size_t ielen, 
	 * copied to new ie, skip ssid, capability, bssid-index ie

	 */

	tmp_new = sub_copy;

	while (tmp_new + tmp_new[1] + 2 - sub_copy <= subie_len) {

	while (tmp_new + 2 - sub_copy <= subie_len &&

	       tmp_new + tmp_new[1] + 2 - sub_copy <= subie_len) {

		if (!(tmp_new[0] == WLAN_EID_NON_TX_BSSID_CAP ||

		      tmp_new[0] == WLAN_EID_SSID ||

		      tmp_new[0] == WLAN_EID_MULTI_BSSID_IDX ||