tree e6f94c8d640c0d7e879381a74d58557d1c91922b
parent e7eb6dd04a94f2484c9642fc0f5ba45207b3cf4e
author Gururaj Patil <gururaj.patil3@harman.com> 1573206580 +0000
committer Maarten Derks <maarten@fairphone.com> 1574969626 +0000

wlan: Fix OOB read in sme_RrmProcessBeaconReportReqInd

Propagate from cld-3.0 to prima.

When beacon report request action frame is received,
rrmProcessBeaconReportReq() is called and num_channels value
is calculated from the action frame directly from user. This
value is assigned to pSmeBcnReportReq->channelList.numChannels
and this num channels value along with the channel list is
posted to sme for further processing. The sme function
sme_RrmProcessBeaconReportReqInd() processes this sme
message eWNI_SME_BEACON_REPORT_REQ_IND. In this function,
the channels in channel list are looped through the received
value pBeaconReq->channelList.numChannels and is copied to the
destination pSmeRrmContext->channelList array from the
pBeaconReq->channelList.channelNumber[] array.
The maximum possible number of channels in channel list
BeaconReq->channelList.channelNumber[] allocated statically
in the definition of tSirChannelList is
SIR_ESE_MAX_MEAS_IE_REQS (8).
So when the pBeaconReq->channelList.numChannels, possible OOB
read occurs.

Validate the value of pBeaconReq->channelList.numChannels
received from the action frame against the maximum supported
number of channels in channel list SIR_ESE_MAX_MEAS_IE_REQS (8).
Place this validation inside the function
sme_RrmProcessBeaconReportReqInd() instead of validating it
at rrmProcessBeaconReportReq() so that it defends from other
caller sme_SetEseBeaconRequest() which is from user space
command through IOCTL.

Issue: SEC-1948
CRs-Fixed: 2462152
Signed-off-by: Gururaj Patil <gururaj.patil3@harman.com>
Change-Id: I85231a238c609ed17d97fa2c41bb95bfd8f9396d