From 0ed8dbf042a7b00ad9efa10d1f6a945b1423682f Mon Sep 17 00:00:00 2001 From: Vinay Gannevaram Date: Mon, 20 Jan 2020 13:20:30 +0530 Subject: qcwcn: Heap-buffer-overflow in register_monitor_sock() of wifi hal This changes is to avoid the buffer-overflow in register_monitor_sock() where "nreg->monsock" is getting filled with the data of length "ctrl_msg->monsock_len" without the validation of length. Address this issue by have a length check done before filling the buffer. Bug: 149836664 Test: Manual - Basic wifi sanity test CRs-Fixed: 2604404 Change-Id: I36b7ac274bd4f92eceabd5bd6534c73ae5a9ae73 Signed-off-by: Vinay Gannevaram --- qcwcn/wifi_hal/wifi_hal.cpp | 6 ++++++ 1 file changed, 6 insertions(+) (limited to 'qcwcn/wifi_hal') diff --git a/qcwcn/wifi_hal/wifi_hal.cpp b/qcwcn/wifi_hal/wifi_hal.cpp index cb770ee..61f7ee6 100644 --- a/qcwcn/wifi_hal/wifi_hal.cpp +++ b/qcwcn/wifi_hal/wifi_hal.cpp @@ -1291,6 +1291,12 @@ static int register_monitor_sock(wifi_handle handle, wifihal_ctrl_req_t *ctrl_ms if(attach) { + if (ctrl_msg->monsock_len > sizeof(struct sockaddr_un)) + { + ALOGE("%s: Invalid monitor socket length \n", __FUNCTION__); + return -3; + } + nreg = (wifihal_mon_sock_t *)malloc(sizeof(*reg) + match_len); if (!nreg) return -1; -- cgit v1.2.3