Staging: rtl8723bs: rtw_wlan_util: Add size check of SSID IE
Add size check of SSID information element in incoming 802.11 frames, to prevent memcpy() of IE in array bssid->Ssid.Ssid, with size more than 32 bytes. Signed-off-by: Denis Straghkov <d.straghkov@ispras.ru> Reviewed-by: Dan Carpenter <dan.carpenter@oracle.com> Link: https://lore.kernel.org/r/20200421212525.24962-1-d.straghkov@ispras.ru Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>
This commit is contained in:
parent
1bc355cff2
commit
370730894b
@ -1271,13 +1271,13 @@ int rtw_check_bcn_info(struct adapter *Adapter, u8 *pframe, u32 packet_len)
|
||||
unsigned char *pbuf;
|
||||
u32 wpa_ielen = 0;
|
||||
u8 *pbssid = GetAddr3Ptr(pframe);
|
||||
u32 hidden_ssid = 0;
|
||||
struct HT_info_element *pht_info = NULL;
|
||||
struct rtw_ieee80211_ht_cap *pht_cap = NULL;
|
||||
u32 bcn_channel;
|
||||
unsigned short ht_cap_info;
|
||||
unsigned char ht_info_infos_0;
|
||||
struct mlme_priv *pmlmepriv = &Adapter->mlmepriv;
|
||||
int ssid_len;
|
||||
|
||||
if (is_client_associated_to_ap(Adapter) == false)
|
||||
return true;
|
||||
@ -1370,21 +1370,15 @@ int rtw_check_bcn_info(struct adapter *Adapter, u8 *pframe, u32 packet_len)
|
||||
}
|
||||
|
||||
/* checking SSID */
|
||||
ssid_len = 0;
|
||||
p = rtw_get_ie(bssid->IEs + _FIXED_IE_LENGTH_, _SSID_IE_, &len, bssid->IELength - _FIXED_IE_LENGTH_);
|
||||
if (!p) {
|
||||
DBG_871X("%s marc: cannot find SSID for survey event\n", __func__);
|
||||
hidden_ssid = true;
|
||||
} else {
|
||||
hidden_ssid = false;
|
||||
}
|
||||
|
||||
if ((NULL != p) && (false == hidden_ssid && (*(p + 1)))) {
|
||||
memcpy(bssid->Ssid.Ssid, (p + 2), *(p + 1));
|
||||
bssid->Ssid.SsidLength = *(p + 1);
|
||||
} else {
|
||||
bssid->Ssid.SsidLength = 0;
|
||||
bssid->Ssid.Ssid[0] = '\0';
|
||||
if (p) {
|
||||
ssid_len = *(p + 1);
|
||||
if (ssid_len > NDIS_802_11_LENGTH_SSID)
|
||||
ssid_len = 0;
|
||||
}
|
||||
memcpy(bssid->Ssid.Ssid, (p + 2), ssid_len);
|
||||
bssid->Ssid.SsidLength = ssid_len;
|
||||
|
||||
RT_TRACE(_module_rtl871x_mlme_c_, _drv_info_, ("%s bssid.Ssid.Ssid:%s bssid.Ssid.SsidLength:%d "
|
||||
"cur_network->network.Ssid.Ssid:%s len:%d\n", __func__, bssid->Ssid.Ssid,
|
||||
|
Loading…
Reference in New Issue
Block a user