From 453d319e77330b68bd001b44e353445dc273125b Mon Sep 17 00:00:00 2001
From: dataanddreams <dataanddreams@gmail.com>
Date: Tue, 1 Dec 2015 10:57:28 -0500
Subject: [PATCH] bcmdhd: Add checks for stack buffer overflows
These two checks prevent exploitable buffer overflows in two scenarios.
1. Long WPS_ID_DEVICE_NAME in WPS info elements
2. Invalid SSID determined in certain scan results
Bug: 25661991
Change-Id: Ie2f99897df2e4ce9fabcc03bb6091796777f95fa
---
drivers/net/wireless/bcmdhd/wl_cfg80211.c | 9 +++++++--
1 file changed, 7 insertions(+), 2 deletions(-)
diff --git a/drivers/net/wireless/bcmdhd/wl_cfg80211.c b/drivers/net/wireless/bcmdhd/wl_cfg80211.c
index ee13c6d7c626..968461319248 100644
--- a/drivers/net/wireless/bcmdhd/wl_cfg80211.c
+++ b/drivers/net/wireless/bcmdhd/wl_cfg80211.c
@@ -1016,8 +1016,9 @@ wl_validate_wps_ie(char *wps_ie, s32 wps_ie_len, bool *pbc)
WL_DBG((" attr WPS_ID_CONFIG_METHODS: %x\n", HTON16(val)));
} else if (subelt_id == WPS_ID_DEVICE_NAME) {
char devname[100];
- memcpy(devname, subel, subelt_len);
- devname[subelt_len] = '\0';
+ size_t namelen = MIN(subelt_len, sizeof(devname));
+ memcpy(devname, subel, namelen);
+ devname[namelen-1] = '\0';
WL_DBG((" attr WPS_ID_DEVICE_NAME: %s (len %u)\n",
devname, subelt_len));
} else if (subelt_id == WPS_ID_DEVICE_PWD_ID) {
@@ -8345,6 +8346,10 @@ wl_notify_sched_scan_results(struct wl_priv *wl, struct net_device *ndev,
* scan request in the form of cfg80211_scan_request. For timebeing, create
* cfg80211_scan_request one out of the received PNO event.
*/
+ ssid[i].ssid_len = MIN(DOT11_MAX_SSID_LEN, netinfo->pfnsubnet.SSID_len);
+ memcpy(ssid[i].ssid, netinfo->pfnsubnet.SSID, ssid[i].ssid_len);
+ request->n_ssids++;
+
memcpy(ssid[i].ssid, netinfo->pfnsubnet.SSID,
netinfo->pfnsubnet.SSID_len);
ssid[i].ssid_len = netinfo->pfnsubnet.SSID_len;
--
GitLab