DivestOS/Patches/Linux_CVEs/CVE-2017-9714/qcacld-2.0/0001.patch
2017-11-07 18:55:10 -05:00

63 lines
3.0 KiB
Diff

From aae237dfbaf8edcf310eeb84b887b20e7e9c0ff3 Mon Sep 17 00:00:00 2001
From: Kapil Gupta <kapgupta@codeaurora.org>
Date: Tue, 16 May 2017 12:39:54 +0530
Subject: qcacld-2.0: Drop assoc request if RSNIE/WPAIE parsing fail
Add changes to drop assoc request and return error if RSNIE or
WPAIE parsing fail during parsing of assoc request.
CRs-Fixed: 2046578
Change-Id: I88d779399c2eba5d33c30144bf9600a1f3a00b77
---
CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c | 23 +++++++++++++++++++----
1 file changed, 19 insertions(+), 4 deletions(-)
diff --git a/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c b/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c
index 7aa5464..23d2cf3 100644
--- a/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c
+++ b/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c
@@ -752,10 +752,18 @@ limProcessAssocReqFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo,
if(pAssocReq->rsn.length)
{
// Unpack the RSN IE
- dot11fUnpackIeRSN(pMac,
+ if (dot11fUnpackIeRSN(pMac,
&pAssocReq->rsn.info[0],
pAssocReq->rsn.length,
- &Dot11fIERSN);
+ &Dot11fIERSN) != DOT11F_PARSE_SUCCESS)
+ {
+ limLog(pMac, LOG1,
+ FL("Invalid RSNIE received"));
+ limSendAssocRspMgmtFrame(pMac,
+ eSIR_MAC_INVALID_RSN_IE_CAPABILITIES_STATUS,
+ 1, pHdr->sa, subType, 0,psessionEntry);
+ goto error;
+ }
/* Check RSN version is supported or not */
if(SIR_MAC_OUI_VERSION_1 == Dot11fIERSN.version)
@@ -821,10 +829,17 @@ limProcessAssocReqFrame(tpAniSirGlobal pMac, tANI_U8 *pRxPacketInfo,
// Unpack the WPA IE
if(pAssocReq->wpa.length)
{
- dot11fUnpackIeWPA(pMac,
+ if (dot11fUnpackIeWPA(pMac,
&pAssocReq->wpa.info[4], //OUI is not taken care
pAssocReq->wpa.length,
- &Dot11fIEWPA);
+ &Dot11fIEWPA) != DOT11F_PARSE_SUCCESS)
+ {
+ limLog(pMac, LOGE, FL("Invalid WPA IE"));
+ limSendAssocRspMgmtFrame(pMac,
+ eSIR_MAC_INVALID_INFORMATION_ELEMENT_STATUS,
+ 1, pHdr->sa, subType, 0,psessionEntry);
+ goto error;
+ }
/* check the groupwise and pairwise cipher suites */
if(eSIR_SUCCESS != (status = limCheckRxWPAIeMatch(pMac, Dot11fIEWPA, psessionEntry, pAssocReq->HTCaps.present)))
{
--
cgit v1.1