commit e58f3bc405df832a2a0dd4d5ffca4a221814e9c4
author Abhinav Kumar <abhikuma@codeaurora.org> Tue Apr 03 12:59:05 2018 +0530
committer Abhinav Kumar <abhikuma@codeaurora.org> Fri Apr 06 00:13:06 2018 +0530
tree 8a839fb568d6278d5150d7e31a8eb1eb78a4c056
parent 8b14933ce16667976590761f27a3965b503d6962

wlan: Fix to pass appropriate buffer length to unpack RSN IE

In lim_set_rs_nie_wp_aiefrom_sme_start_bss_req_message, length passed
to unpack RSN IE is total length of WPA and RSN IE. So if only WPA IE
is present in assoc request, the RSN IE parser will try to validate the
buffer beyond the RSN IE and might fail as the buffer belongs to WPA IE.
Pass appropriate length to unpack RSN IE.

Change-Id: Ie679e67061e7ac622e8e76b285a32135a60ca6e8
CRs-Fixed: 2217268

CORE/MAC/src/pe/lim/limSmeReqUtils.c

diff --git a/CORE/MAC/src/pe/lim/limSmeReqUtils.c b/CORE/MAC/src/pe/lim/limSmeReqUtils.c
index 42689a2..1adc7de 100644
--- a/CORE/MAC/src/pe/lim/limSmeReqUtils.c
+++ b/CORE/MAC/src/pe/lim/limSmeReqUtils.c
@@ -335,7 +335,9 @@
                    LOG1,
                    FL("Only RSN IE is present"));
             dot11fUnpackIeRSN(pMac,&pRSNie->rsnIEdata[2],
-                              (tANI_U8)pRSNie->length,&pSessionEntry->gStartBssRSNIe);
+                              pRSNie->rsnIEdata[1],
+                              &pSessionEntry->gStartBssRSNIe);
+            return true;
         }
         else if ((pRSNie->length == pRSNie->rsnIEdata[1] + 2) &&
                  (pRSNie->rsnIEdata[0] == SIR_MAC_WPA_EID))
@@ -344,8 +346,10 @@
                    LOG1,
                    FL("Only WPA IE is present"));
 
-            dot11fUnpackIeWPA(pMac,&pRSNie->rsnIEdata[6],(tANI_U8)pRSNie->length-4,
-                                &pSessionEntry->gStartBssWPAIe);
+            dot11fUnpackIeWPA(pMac,&pRSNie->rsnIEdata[6],
+                              pRSNie->rsnIEdata[1] - 4,
+                              &pSessionEntry->gStartBssWPAIe);
+            return true;
         }
 
         // Check validity of WPA IE
@@ -371,7 +375,7 @@
             {
                 /* Both RSN and WPA IEs are present */
                 dot11fUnpackIeRSN(pMac,&pRSNie->rsnIEdata[2],
-                      (tANI_U8)pRSNie->length,&pSessionEntry->gStartBssRSNIe);
+                      pRSNie->rsnIEdata[1], &pSessionEntry->gStartBssRSNIe);
 
                 dot11fUnpackIeWPA(pMac,&pRSNie->rsnIEdata[wpaIndex + 6],
                                  pRSNie->rsnIEdata[wpaIndex + 1]-4,