Donate to e Foundation | Murena handsets with /e/OS | Own a part of Murena! Learn more

Unverified Commit 6e21d7ff authored by derfelot's avatar derfelot Committed by GitHub
Browse files

Merge pull request #3 from derfelot/lineage-17.1_asb_2020-08

[lineage-17.1] Android Security Bulletin 2020-08
parents 87f7feee 23f3ae56
Loading
Loading
Loading
Loading
+11 −5
Original line number Diff line number Diff line
@@ -1103,8 +1103,9 @@ hdd_send_ft_assoc_response(struct net_device *dev,
	unsigned int len = 0;
	u8 *pFTAssocRsp = NULL;

	if (pCsrRoamInfo->nAssocRspLength == 0) {
		hdd_debug("assoc rsp length is 0");
	if (pCsrRoamInfo->nAssocRspLength < FT_ASSOC_RSP_IES_OFFSET) {
		hdd_debug("Invalid assoc rsp length %d",
			  pCsrRoamInfo->nAssocRspLength);
		return;
	}

@@ -1121,15 +1122,20 @@ hdd_send_ft_assoc_response(struct net_device *dev,
		   (unsigned int)pFTAssocRsp[0],
		   (unsigned int)pFTAssocRsp[1]);

	/* Send the Assoc Resp, the supplicant needs this for initial Auth. */
	len = pCsrRoamInfo->nAssocRspLength - FT_ASSOC_RSP_IES_OFFSET;
	if (len > IW_GENERIC_IE_MAX) {
		hdd_err("Invalid Assoc resp length %d", len);
		return;
	}
	wrqu.data.length = len;

	/* We need to send the IEs to the supplicant. */
	buff = qdf_mem_malloc(IW_GENERIC_IE_MAX);
	if (buff == NULL) {
		hdd_err("unable to allocate memory");
		return;
	}
	/* Send the Assoc Resp, the supplicant needs this for initial Auth. */
	len = pCsrRoamInfo->nAssocRspLength - FT_ASSOC_RSP_IES_OFFSET;
	wrqu.data.length = len;
	memcpy(buff, pFTAssocRsp, len);
	wireless_send_event(dev, IWEVASSOCRESPIE, &wrqu, buff);

+1 −1
Original line number Diff line number Diff line
@@ -746,7 +746,7 @@ rrm_fill_beacon_ies(tpAniSirGlobal pMac,
		pIes += sizeof(uint16_t);
	}

	while (BcnNumIes > 0) {
	while (BcnNumIes >= 2) {
		len = *(pBcnIes + 1);
		len += 2;       /* element id + length. */
		pe_debug("EID = %d, len = %d total = %d",