DivestOS/Patches/Linux_CVEs/CVE-2016-8476/ANY/1.patch

51 lines
2.2 KiB
Diff
Raw Normal View History

From 391b6eea59269ce8962c2ae160de6c8ac8bb4967 Mon Sep 17 00:00:00 2001
From: Srinivas Girigowda <sgirigow@codeaurora.org>
Date: Mon, 21 Nov 2016 19:05:28 -0800
Subject: [PATCH] qcacld-2.0: Validate "set passpoint list" network count
Currently when processing the "set passpoint list" vendor command the
"number of networks" parameter is not limit checked. This value is
subsequently used to calculate the size of a buffer. Add a limit check
to ensure that an appropriately sized buffer is always allocated.
Change-Id: Ibc2346b8a62898fc47e2d1efe457c57c08b0cada
CRs-Fixed: 1091940
Bug: 32879283
Signed-off-by: Srinivas Girigowda <sgirigow@codeaurora.org>
---
drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_cfg80211.c | 7 ++++++-
drivers/staging/qcacld-2.0/CORE/MAC/inc/sirApi.h | 1 +
2 files changed, 7 insertions(+), 1 deletion(-)
diff --git a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_cfg80211.c b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_cfg80211.c
index e628b575350e4..82275c27ae587 100644
--- a/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_cfg80211.c
+++ b/drivers/staging/qcacld-2.0/CORE/HDD/src/wlan_hdd_cfg80211.c
@@ -5111,8 +5111,13 @@ static int __wlan_hdd_cfg80211_set_passpoint_list(struct wiphy *wiphy,
}
num_networks = nla_get_u32(
tb[QCA_WLAN_VENDOR_ATTR_PNO_PASSPOINT_LIST_PARAM_NUM]);
- hddLog(LOG1, FL("num networks %u"), num_networks);
+ if (num_networks > SIR_PASSPOINT_LIST_MAX_NETWORKS) {
+ hddLog(LOGE, FL("num networks %u exceeds max %u"),
+ num_networks, SIR_PASSPOINT_LIST_MAX_NETWORKS);
+ return -EINVAL;
+ }
+ hddLog(LOG1, FL("num networks %u"), num_networks);
req_msg = vos_mem_malloc(sizeof(*req_msg) +
(num_networks * sizeof(req_msg->networks[0])));
if (!req_msg) {
diff --git a/drivers/staging/qcacld-2.0/CORE/MAC/inc/sirApi.h b/drivers/staging/qcacld-2.0/CORE/MAC/inc/sirApi.h
index e6ff7c0967ddb..34287b3c3095d 100644
--- a/drivers/staging/qcacld-2.0/CORE/MAC/inc/sirApi.h
+++ b/drivers/staging/qcacld-2.0/CORE/MAC/inc/sirApi.h
@@ -5580,6 +5580,7 @@ struct wifi_epno_params
struct wifi_epno_network networks[];
};
+#define SIR_PASSPOINT_LIST_MAX_NETWORKS 8
#define SIR_PASSPOINT_REALM_LEN 256
#define SIR_PASSPOINT_ROAMING_CONSORTIUM_ID_NUM 16
#define SIR_PASSPOINT_PLMN_LEN 3