commit 2855c95f27f6fc7a4e8cf98c1e392bf33e272079
author Ashish Kumar Dhanotiya <adhanoti@codeaurora.org> Tue Jan 02 19:52:26 2018 +0530
committer Gerrit - the friendly Code Review server <code-review@localhost> Thu Jan 18 01:04:36 2018 -0800
tree a6d0fc307883b01127937f75ea573165c0263e78
parent 3c23c60b9f029e4e25b4bd168cc29855ce52b6d3

wlan: Bounds check key length in __iw_set_ap_encodeext

propagation from qcacld-3.0 to prima

___iw_set_ap_encodeext iterates over a key buffer based on a length that
may be larger than the key buffer size. Bounds check the key length
before iterating over the buffer, and reject the call if the length is
too large.

Change-Id: I2473905500470ab6c4e83f5822949bbc9d94f5f1
CRs-Fixed: 2165804

CORE/HDD/src/wlan_hdd_hostapd.c

diff --git a/CORE/HDD/src/wlan_hdd_hostapd.c b/CORE/HDD/src/wlan_hdd_hostapd.c
index afc9435..0806e67 100644
--- a/CORE/HDD/src/wlan_hdd_hostapd.c
+++ b/CORE/HDD/src/wlan_hdd_hostapd.c
@@ -4097,7 +4097,7 @@
          /*Convert from 1-based to 0-based keying*/
         key_index--;
     }
-    if(!ext->key_len) {
+    if(!ext->key_len || ext->key_len > CSR_MAX_KEY_LEN) {
 #if 0
       /*Set the encrytion type to NONE*/
 #if 0
@@ -4143,7 +4143,7 @@
              retval = -EINVAL;
          }
 #endif
-         return retval;
+         return -EINVAL;
 
     }
     
@@ -4152,9 +4152,7 @@
     setKey.keyId = key_index;
     setKey.keyLength = ext->key_len;
    
-    if(ext->key_len <= CSR_MAX_KEY_LEN) {
-       vos_mem_copy(&setKey.Key[0],ext->key,ext->key_len);
-    }   
+    vos_mem_copy(&setKey.Key[0],ext->key,ext->key_len);
    
     if(ext->ext_flags & IW_ENCODE_EXT_GROUP_KEY) {
       /*Key direction for group is RX only*/