commit f5a30837ef69a7d806fe4c724d0cc866cf4df07f
author Vinay Krishna Eranna <c_veran@qti.qualcomm.com> Wed Aug 13 18:44:37 2014 +0530
committer Satyanarayana Dash <c_sadash@qti.qualcomm.com> Tue Aug 26 11:44:00 2014 +0530
tree d193b2a508c994636a3866496d4d18256225994f
parent 20aa658f1a9c3fdca0e8c8a859bef6a7f9019ed0

wlan: Fail to load driver if INI file is corrupted

Avoid over parsing of the INI buffer which leads to
memory corruption and fail the driver load if INI
buffer seems to be corrupt.

Change-Id: I3252d033ec6faea5f5979e8b631dc766a5c5dd1c
CRs-Fixed: 707317

CORE/HDD/src/wlan_hdd_cfg.c

diff --git a/CORE/HDD/src/wlan_hdd_cfg.c b/CORE/HDD/src/wlan_hdd_cfg.c
index ec61a3d..a64b83e 100644
--- a/CORE/HDD/src/wlan_hdd_cfg.c
+++ b/CORE/HDD/src/wlan_hdd_cfg.c
@@ -3195,7 +3195,6 @@
   }
   else
   {
-    *str = '\0';
     return (str+1);
   }
 
@@ -3295,7 +3294,7 @@
       goto config_exit;
    }
 
-   hddLog(LOG1, "%s: qcom_cfg.ini Size %zu", __func__, fw->size);
+   hddLog(LOGE, "%s: qcom_cfg.ini Size %zu", __func__, fw->size);
 
    buffer = (char*)vos_mem_malloc(fw->size);
 
@@ -3311,7 +3310,26 @@
 
    while (buffer != NULL)
    {
+      /*
+       * get_next_line function used to modify the \n and \r delimiter
+       * to \0 before returning, without checking if it is over parsing the
+       * source buffer. So changed the function not to modify the buffer
+       * passed to it and letting the calling/caller function to take
+       * care of the return pointer validation and modification of the buffer.
+       * So validating if the return pointer is not greater than the end
+       * buffer address and modifying the buffer value.
+       */
       line = get_next_line(buffer);
+      if(line > (pTemp + fw->size)) {
+         hddLog(VOS_TRACE_LEVEL_FATAL, "%s: INI file seems to be corrupted",
+                  __func__);
+         vos_status = VOS_STATUS_E_FAILURE;
+         goto config_exit;
+      }
+      else if(line) {
+         *(line - 1) = '\0';
+      }
+
       buffer = i_trim(buffer);
 
       hddLog(LOG1, "%s: item", buffer);