commit cc33f9834a471bf69117cb28e07d77a86557b616
author Yeshwanth Sriram Guntuka <ysriramg@codeaurora.org> Mon Dec 03 17:04:29 2018 +0530
committer Yeshwanth Sriram Guntuka <ysriramg@codeaurora.org> Tue Dec 11 13:18:46 2018 +0530
tree dbbbc612db3bcfad23b8ed5da8d2737f7eb7540d
parent aa083c9a0ad1257687852afb751524a317ed757c

wlan: Skip IE which has length less than the minimum valid IE length

QBSS IE uses min length of 4 bytes for version 1 and
min length of 5 bytes for version 2. Min length used
for IE is 5 bytes in driver which can cause WPA IE
parse failure if QBSS IE is 4 bytes resulting in failure
in fetching scan results due to security mismatch and
subsequently connection failure.

Fix is to skip the IE which has length less than the
minimum valid length.

Change-Id: I00fbffad221e2d9ecedcb87c9607ac8abd7c55b1
CRs-Fixed: 2348006

CORE/MAC/src/include/dot11f.h

diff --git a/CORE/MAC/src/include/dot11f.h b/CORE/MAC/src/include/dot11f.h
index cc2496a..2c2da5c 100644
--- a/CORE/MAC/src/include/dot11f.h
+++ b/CORE/MAC/src/include/dot11f.h
@@ -32,7 +32,7 @@
   * \brief Structures, function prototypes & definitions
   * for working with 802.11 Frames
   * This file was automatically generated by 'framesc'
-  * Thu Nov 22 19:11:37 2018 from the following file(s):
+  * Mon Dec  3 16:47:12 2018 from the following file(s):
   *
   * dot11f.frms
   *

CORE/SYS/legacy/src/utils/src/dot11f.c

diff --git a/CORE/SYS/legacy/src/utils/src/dot11f.c b/CORE/SYS/legacy/src/utils/src/dot11f.c
index ceb2078..50e1df2 100644
--- a/CORE/SYS/legacy/src/utils/src/dot11f.c
+++ b/CORE/SYS/legacy/src/utils/src/dot11f.c
@@ -30,7 +30,7 @@
   * \brief Structures, functions & definitions for
   * working with 802.11 Frames
   * This file was automatically generated by 'framesc'
-  * Thu Nov 22 19:11:37 2018 from the following file(s):
+  * Mon Dec  3 16:47:12 2018 from the following file(s):
   *
   * dot11f.frms
   *
@@ -22723,16 +22723,13 @@
 
         if (pIe)
         {
-            if ((nBufRemaining < pIe->minSize - pIe->noui - 2U) ||
-                (len < pIe->minSize - pIe->noui - 2U))
+            if ((nBufRemaining < pIe->minSize - pIe->noui - 2U))
             {
-                FRAMES_LOG4(pCtx, FRLOGW, FRFL("The IE %s must "
+                FRAMES_LOG3(pCtx, FRLOGW, FRFL("The IE %s must "
                    "be at least %d bytes in size, but "
                    "there are only %d bytes remaining in "
-                   "this frame or the IE reports a size "
-                   "of %d bytes.\n"),
-                    pIe->name, pIe->minSize, nBufRemaining,
-                    (len + pIe->noui + 2U));
+                   "this frame.\n"),
+                    pIe->name, pIe->minSize, nBufRemaining);
                 FRAMES_DUMP(pCtx, FRLOG1, pBuf, nBuf);
                 status |= DOT11F_INCOMPLETE_IE;
                 FRAMES_DBG_BREAK();
@@ -22740,6 +22737,14 @@
             }
             else
             {
+                if (len < pIe->minSize - pIe->noui - 2U) {
+                     FRAMES_LOG3(pCtx, FRLOGW, FRFL("The IE %s must "
+                         "be at least %d bytes in size, but "
+                         "there are only %d bytes in the IE\n"),
+                         pIe->name, pIe->minSize, (len + pIe->noui + 2U));
+                     goto skip_ie;
+               }
+
                 if (len > pIe->maxSize - pIe->noui - 2U){
                 FRAMES_LOG1(pCtx, FRLOGW, FRFL("The IE %s reports "
                     "an unexpectedly large size; it is presumably "
@@ -22752,7 +22757,7 @@
         countOffset = ( (0 != pIe->arraybound) * ( *(tANI_U16* )(pFrm + pIe->countOffset)));
         if (0 != pIe->arraybound && countOffset >= pIe->arraybound) {
             status |= DOT11F_DUPLICATE_IE;
-            goto skip_dup_ie;
+            goto skip_ie;
         }
                 switch (pIe->sig)
                 {
@@ -23232,7 +23237,7 @@
             status |= DOT11F_UNKNOWN_IES;
         }
 
-skip_dup_ie:
+skip_ie:
         pBufRemaining += len;
 
          if (len > nBufRemaining)