commit 1b59f11221d5d0c712e0e13b1b7d1ea675a1d3b4
author Kapil Gupta <kapgupta@codeaurora.org> Tue Jun 06 12:05:22 2017 +0530
committer Jordy van Wolferen <jordy@fairphone.com> Mon Sep 18 16:31:36 2017 +0200
tree b3e791932bd61d5db0939a4e8b53202c56b479fe
parent dfca8a024cccca4b9e25d5a4b6745c009bbe2c05

wlan: Drop assoc request if RSNIE/WPAIE parsing fail

Add changes to drop assoc request and return error if RSNIE or
WPAIE parsing fail during parsing of assoc request.

FPIIM-1601

CRs-Fixed: 2056775
Change-Id: I88d779399c2eba5d33c30144bf9600a1f3a00b77

CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c

diff --git a/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c b/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c
index 5728b30..6ba86ca 100644
--- a/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c
+++ b/CORE/MAC/src/pe/lim/limProcessAssocReqFrame.c
@@ -701,10 +701,18 @@
                 if(pAssocReq->rsn.length)
                 {
                     // Unpack the RSN IE 
-                    dot11fUnpackIeRSN(pMac, 
+                    if (dot11fUnpackIeRSN(pMac,
                                         &pAssocReq->rsn.info[0], 
                                         pAssocReq->rsn.length, 
-                                        &Dot11fIERSN);
+                                        &Dot11fIERSN) != DOT11F_PARSE_SUCCESS)
+                    {
+                        limLog(pMac, LOGE,
+                               FL("Invalid RSNIE received"));
+                        limSendAssocRspMgmtFrame(pMac,
+                              eSIR_MAC_INVALID_RSN_IE_CAPABILITIES_STATUS,
+                              1, pHdr->sa, subType, 0,psessionEntry);
+                        goto error;
+                    }
 
                     /* Check RSN version is supported or not */
                     if(SIR_MAC_OUI_VERSION_1 == Dot11fIERSN.version)
@@ -771,10 +779,17 @@
                 // Unpack the WPA IE 
                 if(pAssocReq->wpa.length)
                 {
-                    dot11fUnpackIeWPA(pMac, 
+                    if (dot11fUnpackIeWPA(pMac,
                                         &pAssocReq->wpa.info[4], //OUI is not taken care
                                         pAssocReq->wpa.length, 
-                                        &Dot11fIEWPA);
+                                        &Dot11fIEWPA) != DOT11F_PARSE_SUCCESS)
+                    {
+                        limLog(pMac, LOGE, FL("Invalid WPA IE"));
+                        limSendAssocRspMgmtFrame(pMac,
+                            eSIR_MAC_INVALID_INFORMATION_ELEMENT_STATUS,
+                            1, pHdr->sa, subType, 0,psessionEntry);
+                        goto error;
+                    }
                     /* check the groupwise and pairwise cipher suites */
                     if(eSIR_SUCCESS != (status = limCheckRxWPAIeMatch(pMac, Dot11fIEWPA, psessionEntry, pAssocReq->HTCaps.present)))
                     {