TechPanelGM/kernel_xiaomi_sm8250
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Merge tag 'LA.UM.9.12.r1-18200-SMxx50.QSSI14.0' of https://git.codelinaro.org/clo/la/platform/vendor/qcom-opensource/wlan/qca-wifi-host-cmn into android13-4.19-kona

Browse Source 
"LA.UM.9.12.r1-18200-SMxx50.QSSI14.0"

* tag 'LA.UM.9.12.r1-18200-SMxx50.QSSI14.0' of https://git.codelinaro.org/clo/la/platform/vendor/qcom-opensource/wlan/qca-wifi-host-cmn:
  qcacmn: Fix out of bound read issue in ESP ie parse

Change-Id: I3a6260d641417d3580f29f570246df0faa538606
This commit is contained in:
Michael Bestas
2024-03-23 01:09:21 +02:00
parent e061c2504f 50240b4951
commit c1da63f0cd
1 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

7
drivers/staging/qca-wifi-host-cmn/umac/scan/dispatcher/src/wlan_scan_utils_api.c
View File

@@ -1,6 +1,6 @@
/*
* Copyright (c) 2017-2021 The Linux Foundation. All rights reserved.
* Copyright (c) 2022-2023 Qualcomm Innovation Center, Inc. All rights reserved.
* Copyright (c) 2022-2024 Qualcomm Innovation Center, Inc. All rights reserved.
*
* Permission to use, copy, modify, and/or distribute this software for
* any purpose with or without fee is hereby granted, provided that the
@@ -1185,7 +1185,8 @@ static void util_scan_update_esp_data(struct wlan_esp_ie *esp_information,
esp_ie = (struct wlan_esp_ie *)
util_scan_entry_esp_info(scan_entry);
total_elements = esp_ie->esp_len;
// Ignore ESP_ID_EXTN element
total_elements = esp_ie->esp_len - 1;
data = (uint8_t *)esp_ie + 3;
do_div(total_elements, ESP_INFORMATION_LIST_LENGTH);
@@ -1195,7 +1196,7 @@ static void util_scan_update_esp_data(struct wlan_esp_ie *esp_information,
}
for (i = 0; i < total_elements &&
data < ((uint8_t *)esp_ie + esp_ie->esp_len + 3); i++) {
data < ((uint8_t *)esp_ie + esp_ie->esp_len); i++) {
esp_info = (struct wlan_esp_info *)data;
if (esp_info->access_category == ESP_AC_BK) {
qdf_mem_copy(&esp_information->esp_info_AC_BK,