diff options
| author | Harrison Lingren <hlingren@google.com> | 2020-06-05 14:14:31 -0700 |
|---|---|---|
| committer | Harrison Lingren <hlingren@google.com> | 2020-06-05 14:14:31 -0700 |
| commit | ed007124fcb07a2c7199ce32fa73bb85f0665765 (patch) | |
| tree | c7884b96ea1f4ff17d38e34ab46e1db82ec5b0aa | |
| parent | 6972e1915dee23f09528995868f202b142f79e78 (diff) | |
| parent | c43f8339d2b46c33656198d592147a59d4809d9f (diff) | |
| download | qcacld-ed007124fcb07a2c7199ce32fa73bb85f0665765.tar.gz | |
Merge branch 'android-msm-floral-4.14-qt-security-next' into android-msm-floral-4.14-qt
AUG 2020.1
Bug: 157953751
Signed-off-by: Harrison Lingren <hlingren@google.com>
Change-Id: Id6925721081beb69dad67b37531497e160f7d7d7
| -rw-r--r-- | core/hdd/src/wlan_hdd_assoc.c | 16 | ||||
| -rw-r--r-- | core/mac/src/pe/rrm/rrm_api.c | 11 |
2 files changed, 20 insertions, 7 deletions
diff --git a/core/hdd/src/wlan_hdd_assoc.c b/core/hdd/src/wlan_hdd_assoc.c index df1108f977..e4e095097a 100644 --- a/core/hdd/src/wlan_hdd_assoc.c +++ b/core/hdd/src/wlan_hdd_assoc.c @@ -1072,8 +1072,9 @@ hdd_send_ft_assoc_response(struct net_device *dev, unsigned int len = 0; u8 *pFTAssocRsp = NULL; - if (pCsrRoamInfo->nAssocRspLength == 0) { - hdd_debug("assoc rsp length is 0"); + if (pCsrRoamInfo->nAssocRspLength < FT_ASSOC_RSP_IES_OFFSET) { + hdd_debug("Invalid assoc rsp length %d", + pCsrRoamInfo->nAssocRspLength); return; } @@ -1090,15 +1091,20 @@ hdd_send_ft_assoc_response(struct net_device *dev, (unsigned int)pFTAssocRsp[0], (unsigned int)pFTAssocRsp[1]); + /* Send the Assoc Resp, the supplicant needs this for initial Auth. */ + len = pCsrRoamInfo->nAssocRspLength - FT_ASSOC_RSP_IES_OFFSET; + if (len > IW_GENERIC_IE_MAX) { + hdd_err("Invalid Assoc resp length %d", len); + return; + } + wrqu.data.length = len; + /* We need to send the IEs to the supplicant. */ buff = qdf_mem_malloc(IW_GENERIC_IE_MAX); if (buff == NULL) { hdd_err("unable to allocate memory"); return; } - /* Send the Assoc Resp, the supplicant needs this for initial Auth. */ - len = pCsrRoamInfo->nAssocRspLength - FT_ASSOC_RSP_IES_OFFSET; - wrqu.data.length = len; memcpy(buff, pFTAssocRsp, len); wireless_send_event(dev, IWEVASSOCRESPIE, &wrqu, buff); diff --git a/core/mac/src/pe/rrm/rrm_api.c b/core/mac/src/pe/rrm/rrm_api.c index 666fdfcda0..7cbf5eeadb 100644 --- a/core/mac/src/pe/rrm/rrm_api.c +++ b/core/mac/src/pe/rrm/rrm_api.c @@ -727,11 +727,18 @@ rrm_fill_beacon_ies(tpAniSirGlobal pMac, *pNumIes += sizeof(uint16_t); pIes += sizeof(uint16_t); - while (BcnNumIes > 0) { - len = *(pBcnIes + 1) + 2; /* element id + length. */ + while (BcnNumIes >= 2) { + len = *(pBcnIes + 1); + len += 2; /* element id + length. */ pe_debug("EID = %d, len = %d total = %d", *pBcnIes, *(pBcnIes + 1), len); + if (BcnNumIes < len) { + pe_err("RRM: Invalid IE len:%d exp_len:%d", + len, BcnNumIes); + break; + } + i = 0; do { if (((eids == NULL) || (*pBcnIes == eids[i])) && |