prima: Fix possible OOB access in limProcessDisassocFrame
Propagation from cld3.0 to cld2.0.
Further adapted from cld2.0 to prima.
Reason code is extracted from frame data without
validating frame len which could result in out
of bound access. Fix is to validate frame len
before extracting reason code from frame data.
Issue: SEC-1951
Bug: 78530292
Change-Id: I00795a806abcae903dd0daa019aeab990aedc3a7
CRs-Fixed: 2333989
Signed-off-by: Roger Wang <wangroger@google.com>
(adapted from commit b9e963d973d0a507ed88ac8d3199ac7b89e851fb)
diff --git a/drivers/staging/prima/CORE/MAC/src/pe/lim/limProcessDisassocFrame.c b/drivers/staging/prima/CORE/MAC/src/pe/lim/limProcessDisassocFrame.c
index 32e15b2..7a81316 100644
--- a/drivers/staging/prima/CORE/MAC/src/pe/lim/limProcessDisassocFrame.c
+++ b/drivers/staging/prima/CORE/MAC/src/pe/lim/limProcessDisassocFrame.c
@@ -77,12 +77,12 @@
tpSirMacMgmtHdr pHdr;
tpDphHashNode pStaDs;
tLimMlmDisassocInd mlmDisassocInd;
-#ifdef WLAN_FEATURE_11W
+
tANI_U32 frameLen;
-#endif
pHdr = WDA_GET_RX_MAC_HEADER(pRxPacketInfo);
pBody = WDA_GET_RX_MPDU_DATA(pRxPacketInfo);
+ frameLen = WDA_GET_RX_PAYLOAD_LEN(pRxPacketInfo);
if (limIsGroupAddr(pHdr->sa))
@@ -112,7 +112,6 @@
PELOGE(limLog(pMac, LOG1, FL("received an unprotected disassoc from AP"));)
// If the frame received is unprotected, forward it to the supplicant to initiate
// an SA query
- frameLen = WDA_GET_RX_PAYLOAD_LEN(pRxPacketInfo);
//send the unprotected frame indication to SME
limSendSmeUnprotectedMgmtFrameInd( pMac, pHdr->fc.subType,
(tANI_U8*)pHdr, (frameLen + sizeof(tSirMacMgmtHdr)),
@@ -121,6 +120,10 @@
}
#endif
+ if (frameLen < 2) {
+ PELOGE(limLog(pMac, LOGE, FL("frame len less than 2"));)
+ return;
+ }
// Get reasonCode from Disassociation frame body
reasonCode = sirReadU16(pBody);