commit 6af276b00cfaa780a4ee4b3e7adfba0c3c6b3348
author Ashish Kumar Dhanotiya <adhanoti@codeaurora.org> Tue Aug 22 16:53:48 2017 +0530
committer Gerrit - the friendly Code Review server <code-review@localhost> Tue Aug 29 02:32:40 2017 -0700
tree 1314cb49785b4d6bc712c677c17d4e2c2fe93df9
parent 06f9f205da38d913661b50bd1802a8827af64a4b

wlan: Resolve out of bound memory access while processing VSIEs

Currently elem_len is  not  checked against WPS_OUI_TYPE_SIZE
before it uses the buffer for memcmp, this may cause the buffer
overread.
To fix this add the proper comparision logic before the API uses
the buffer.

Change-Id: I9ba63543a529fb88932500be39045fcc19509863
CRs-Fixed: 2096984

CORE/HDD/src/wlan_hdd_cfg80211.c

diff --git a/CORE/HDD/src/wlan_hdd_cfg80211.c b/CORE/HDD/src/wlan_hdd_cfg80211.c
index 5ecdfff..398a8e9 100644
--- a/CORE/HDD/src/wlan_hdd_cfg80211.c
+++ b/CORE/HDD/src/wlan_hdd_cfg80211.c
@@ -9195,7 +9195,7 @@
                     elem_id, elem_len, left);
             return;
         }
-        if (IE_EID_VENDOR == elem_id)
+        if ((IE_EID_VENDOR == elem_id) && (elem_len >= WPS_OUI_TYPE_SIZE))
         {
             /* skipping the VSIE's which we don't want to include or
              * it will be included by existing code