Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Unverified Commit 19be8f1d authored by Sheenam Monga's avatar Sheenam Monga Committed by Michael Bestas
Browse files

BACKPORT: qcacmn: Fix potential OOB read in util_scan_parse_rnr_ie 

Currently, while parsing scan RNR Ie data is moved to
next neighbor_ap_info_field after parsing the current
neighbor_ap_info_field. But in last iteration pointer may
try to access invalid data if (uint8_t *)ie + rnr_ie_len + 2)
bytes are less than sizeof neighbor_ap_info_field and same
is the case with tbtt_length access.

Fix is to add a length check of data + next data size to be parsed
< (uint8_t *)ie + rnr_ie_len + 2) instead of adding a validation
of data length only.

CRs-Fixed: 3710080
Change-Id: I05e5a9a02f0f4f9bc468db894588e676f0a248c0
parent d4244a42

drivers/staging/qca-wifi-host-cmn/umac/scan/dispatcher/src/wlan_scan_utils_api.c

+4 −2
Original line number Diff line number Diff line
@@ -709,7 +709,8 @@ util_scan_parse_rnr_ie(struct scan_cache_entry *scan_entry, 
	rnr_ie_len = ie->ie_len;

	data = (uint8_t *)ie + sizeof(struct ie_header);



	while (data < ((uint8_t *)ie + rnr_ie_len + 2)) {

	while ((data + sizeof(struct neighbor_ap_info_field)) <=

					((uint8_t *)ie + rnr_ie_len + 2)) {

		neighbor_ap_info = (struct neighbor_ap_info_field *)data;

		tbtt_count = neighbor_ap_info->tbtt_header.tbtt_info_count;

		tbtt_length = neighbor_ap_info->tbtt_header.tbtt_info_length;
@@ -725,7 +726,8 @@ util_scan_parse_rnr_ie(struct scan_cache_entry *scan_entry, 
			break;



		for (i = 0; i < (tbtt_count + 1) &&

		     data < ((uint8_t *)ie + rnr_ie_len + 2); i++) {

		     (data + tbtt_length) <=

				((uint8_t *)ie + rnr_ie_len + 2); i++) {

			if (i < MAX_RNR_BSS)

				util_scan_update_rnr(

					&scan_entry->rnr.bss_info[i],