lisa/android_kernel_xiaomi_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacld-3.0: Fix PRE_CAC_SSID check bounds check

Browse Source 
If the ssid_len was greater than the PRE_CAC_SSID string,
memcmp would do an out of bounds memory read. Fix by
adding a length check.

Change-Id: I0d72cfdb2faea74db06640df7418f2a7aecd9afb
CRs-Fixed: 2098988
This commit is contained in:
Houston Hoffman 2017-08-24 16:59:35 -07:00 committed by snandini
parent b10ec496b6
commit 1942caece7
1 changed files with 2 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
core/hdd/src/wlan_hdd_hostapd.c
View File

@ -8196,7 +8196,8 @@ int wlan_hdd_cfg80211_start_bss(struct hdd_adapter *pHostapdAdapter,
}
}
if (!hdd_ctx->config->force_sap_acs &&
!(ssid && (0 == qdf_mem_cmp(ssid, PRE_CAC_SSID, ssid_len)))) {
!(ssid && qdf_str_len(PRE_CAC_SSID) == ssid_len &&
(0 == qdf_mem_cmp(ssid, PRE_CAC_SSID, ssid_len)))) {
pIe = wlan_get_ie_ptr_from_eid(WLAN_EID_SUPP_RATES,
&pMgmt_frame->u.beacon.variable[0],
pBeacon->head_len);