lkml.org 
[lkml]   [2019]   [Oct]   [16]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH] rtlwifi: Fix potential overflow on P2P code
    Date
    Nicolas Waisman noticed that even though noa_len is checked for
    a compatible length it's still possible to overrun the buffers
    of p2pinfo since there's no check on the upper bound of noa_num.
    Bounds check noa_num against P2P_MAX_NOA_NUM.

    Reported-by: Nicolas Waisman <nico@semmle.com>
    Signed-off-by: Laura Abbott <labbott@redhat.com>
    ---
    Compile tested only as this was reported to the security list.
    ---
    drivers/net/wireless/realtek/rtlwifi/ps.c | 14 ++++++++++++++
    1 file changed, 14 insertions(+)

    diff --git a/drivers/net/wireless/realtek/rtlwifi/ps.c b/drivers/net/wireless/realtek/rtlwifi/ps.c
    index 70f04c2f5b17..c5cff598383d 100644
    --- a/drivers/net/wireless/realtek/rtlwifi/ps.c
    +++ b/drivers/net/wireless/realtek/rtlwifi/ps.c
    @@ -754,6 +754,13 @@ static void rtl_p2p_noa_ie(struct ieee80211_hw *hw, void *data,
    return;
    } else {
    noa_num = (noa_len - 2) / 13;
    + if (noa_num > P2P_MAX_NOA_NUM) {
    + RT_TRACE(rtlpriv, COMP_INIT, DBG_LOUD,
    + "P2P notice of absence: invalid noa_num.%d\n",
    + noa_num);
    + return;
    + }
    +
    }
    noa_index = ie[3];
    if (rtlpriv->psc.p2p_ps_info.p2p_ps_mode ==
    @@ -848,6 +855,13 @@ static void rtl_p2p_action_ie(struct ieee80211_hw *hw, void *data,
    return;
    } else {
    noa_num = (noa_len - 2) / 13;
    + if (noa_num > P2P_MAX_NOA_NUM) {
    + RT_TRACE(rtlpriv, COMP_FW, DBG_LOUD,
    + "P2P notice of absence: invalid noa_len.%d\n",
    + noa_len);
    + return;
    +
    + }
    }
    noa_index = ie[3];
    if (rtlpriv->psc.p2p_ps_info.p2p_ps_mode ==
    --
    2.21.0
    \
     
     \ /
      Last update: 2019-10-16 22:58    [W:3.015 / U:3.172 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site