lisa/android_kernel_xiaomi_sm8350
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

qcacld-3.0: Validate user input for null termination

Browse Source 
In hdd_dns_make_name_query() the parameter string is a user controlled
input. The driver assumes that the input is null terminated string and
accordingly the exit condition of the loop is specified. In case the
user sends input with no null termination then it can lead to possible
OOB scenario.

Add a null termination validation on the string so that any erroneous
input is filtered.

Change-Id: I2abb4875569c508179c4488347f7c9aae0666332
CRs-Fixed: 2342812
This commit is contained in:
Sourav Mohapatra 2018-11-30 16:27:05 +05:30 committed by nshrivas
parent 6294afcfa7
commit 47710c31ac
1 changed files with 13 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

16
core/hdd/src/wlan_hdd_cfg80211.c
View File

@ -10328,11 +10328,17 @@ static inline uint8_t *hdd_dns_unmake_name_query(uint8_t *name)
* *
* Return: Byte following constructed DNS name * Return: Byte following constructed DNS name
*/ */
static uint8_t *hdd_dns_make_name_query(const uint8_t *string, uint8_t *buf) static uint8_t *hdd_dns_make_name_query(const uint8_t *string,
uint8_t *buf, uint8_t len)
{ {
uint8_t *length_byte = buf++; uint8_t *length_byte = buf++;
uint8_t c; uint8_t c;
if (string[len - 1]) {
hdd_debug("DNS name is not null terminated");
return NULL;
}
while ((c = *(string++))) { while ((c = *(string++))) {
if (c == '.') { if (c == '.') {
*length_byte = buf - length_byte - 1; *length_byte = buf - length_byte - 1;
@ -10421,8 +10427,12 @@ static int hdd_set_clear_connectivity_check_stats_info(
adapter->track_dns_domain_len = adapter->track_dns_domain_len =
nla_len(tb2[ nla_len(tb2[
STATS_DNS_DOMAIN_NAME]); STATS_DNS_DOMAIN_NAME]);
hdd_dns_make_name_query(domain_name, if (!hdd_dns_make_name_query(
adapter->dns_payload); domain_name,
adapter->dns_payload,
adapter->track_dns_domain_len))
adapter->track_dns_domain_len =
0;
/* DNStracking isn't supported in FW. */ /* DNStracking isn't supported in FW. */
arp_stats_params->pkt_type_bitmap &= arp_stats_params->pkt_type_bitmap &=
~CONNECTIVITY_CHECK_SET_DNS; ~CONNECTIVITY_CHECK_SET_DNS;