diff options
author | Jerry Lee <jerrylee@broadcom.com> | 2016-03-30 17:47:43 -0700 |
---|---|---|
committer | Andrew Bresticker <abrestic@chromium.org> | 2016-04-05 18:22:12 +0000 |
commit | 9c052efad6e651d33334b84c8f1feaf8945e8e7a (patch) | |
tree | 00d7d4069c4abac530baed19c35ec44d5de38537 | |
parent | 8aac20019d324280c02060b09668e044988a8820 (diff) |
Ensure SSID length is correct before memcpy
Bug=26571522
Bug=27240072
Change-Id: Ia650ec88268d0efc3ae33f3435c3e6ee91e6a642
Signed-off-by: Jerry Lee <jerrylee@broadcom.com>
Signed-off-by: Andrew Bresticker <abrestic@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/337262
-rw-r--r-- | drivers/net/wireless/bcmdhd/wl_cfg80211.c | 80 |
1 files changed, 53 insertions, 27 deletions
diff --git a/drivers/net/wireless/bcmdhd/wl_cfg80211.c b/drivers/net/wireless/bcmdhd/wl_cfg80211.c index 0e44bc10016b..96cceacdb887 100644 --- a/drivers/net/wireless/bcmdhd/wl_cfg80211.c +++ b/drivers/net/wireless/bcmdhd/wl_cfg80211.c @@ -2036,15 +2036,17 @@ static void wl_scan_prep(struct bcm_cfg80211 *cfg, struct wl_scan_params *params WL_SCAN(("Scanning all channels\n")); } n_channels = j; + /* Copy ssid array if applicable */ WL_SCAN(("### List of SSIDs to scan ###\n")); if (n_ssids > 0) { offset = offsetof(wl_scan_params_t, channel_list) + n_channels * sizeof(u16); offset = roundup(offset, sizeof(u32)); ptr = (char*)params + offset; + for (i = 0; i < n_ssids; i++) { memset(&ssid, 0, sizeof(wlc_ssid_t)); - ssid.SSID_len = request->ssids[i].ssid_len; + ssid.SSID_len = MIN((int)request->ssids[i].ssid_len, DOT11_MAX_SSID_LEN); memcpy(ssid.SSID, request->ssids[i].ssid, ssid.SSID_len); if (!ssid.SSID_len) WL_SCAN(("%d: Broadcast scan\n", i)); @@ -3216,7 +3218,8 @@ wl_cfg80211_join_ibss(struct wiphy *wiphy, struct net_device *dev, WL_TRACE(("In\n")); RETURN_EIO_IF_NOT_UP(cfg); WL_INFORM(("JOIN BSSID:" MACDBG "\n", MAC2STRDBG(params->bssid))); - if (!params->ssid || params->ssid_len <= 0) { + + if (!params->ssid || params->ssid_len <= 0 || params->ssid_len > DOT11_MAX_SSID_LEN) { WL_ERR(("Invalid parameter\n")); return -EINVAL; } @@ -6506,16 +6509,16 @@ static s32 wl_cfg80211_bcn_set_params( } if ((info->ssid) && (info->ssid_len > 0) && - (info->ssid_len <= 32)) { + (info->ssid_len <= DOT11_MAX_SSID_LEN)) { WL_DBG(("SSID (%s) len:%zd \n", info->ssid, info->ssid_len)); if (dev_role == NL80211_IFTYPE_AP) { /* Store the hostapd SSID */ - memset(cfg->hostapd_ssid.SSID, 0x00, 32); + memset(cfg->hostapd_ssid.SSID, 0x00, DOT11_MAX_SSID_LEN); memcpy(cfg->hostapd_ssid.SSID, info->ssid, info->ssid_len); cfg->hostapd_ssid.SSID_len = info->ssid_len; } else { - /* P2P GO */ - memset(cfg->p2p->ssid.SSID, 0x00, 32); + /* P2P GO */ + memset(cfg->p2p->ssid.SSID, 0x00, DOT11_MAX_SSID_LEN); memcpy(cfg->p2p->ssid.SSID, info->ssid, info->ssid_len); cfg->p2p->ssid.SSID_len = info->ssid_len; } @@ -6654,11 +6657,14 @@ wl_cfg80211_bcn_bringup_ap( } memset(&join_params, 0, sizeof(join_params)); + /* join parameters starts with ssid */ join_params_size = sizeof(join_params.ssid); + join_params.ssid.SSID_len = MIN(cfg->hostapd_ssid.SSID_len, + (uint32)DOT11_MAX_SSID_LEN); memcpy(join_params.ssid.SSID, cfg->hostapd_ssid.SSID, - cfg->hostapd_ssid.SSID_len); - join_params.ssid.SSID_len = htod32(cfg->hostapd_ssid.SSID_len); + join_params.ssid.SSID_len); + join_params.ssid.SSID_len = htod32(join_params.ssid.SSID_len); /* create softap */ if ((err = wldev_ioctl(dev, WLC_SET_SSID, &join_params, @@ -7249,20 +7255,22 @@ wl_cfg80211_add_set_beacon(struct wiphy *wiphy, struct net_device *dev, } ie_offset = DOT11_MGMT_HDR_LEN + DOT11_BCN_PRB_FIXED_LEN; + /* find the SSID */ if ((ssid_ie = bcm_parse_tlvs((u8 *)&info->head[ie_offset], info->head_len - ie_offset, DOT11_MNG_SSID_ID)) != NULL) { if (dev_role == NL80211_IFTYPE_AP) { /* Store the hostapd SSID */ - memset(&cfg->hostapd_ssid.SSID[0], 0x00, 32); - memcpy(&cfg->hostapd_ssid.SSID[0], ssid_ie->data, ssid_ie->len); - cfg->hostapd_ssid.SSID_len = ssid_ie->len; + memset(&cfg->hostapd_ssid.SSID[0], 0x00, DOT11_MAX_SSID_LEN); + cfg->hostapd_ssid.SSID_len = MIN((int)ssid_ie->len, DOT11_MAX_SSID_LEN); + memcpy(&cfg->hostapd_ssid.SSID[0], ssid_ie->data, + cfg->hostapd_ssid.SSID_len); } else { - /* P2P GO */ - memset(&cfg->p2p->ssid.SSID[0], 0x00, 32); - memcpy(cfg->p2p->ssid.SSID, ssid_ie->data, ssid_ie->len); - cfg->p2p->ssid.SSID_len = ssid_ie->len; + /* P2P GO */ + memset(&cfg->p2p->ssid.SSID[0], 0x00, DOT11_MAX_SSID_LEN); + cfg->p2p->ssid.SSID_len = MIN((int)ssid_ie->len, DOT11_MAX_SSID_LEN); + memcpy(cfg->p2p->ssid.SSID, ssid_ie->data, cfg->p2p->ssid.SSID_len); } } @@ -7410,8 +7418,10 @@ wl_cfg80211_sched_scan_start(struct wiphy *wiphy, ssid = &request->match_sets[i].ssid; /* No need to include null ssid */ if (ssid->ssid_len) { - memcpy(ssids_local[ssid_cnt].SSID, ssid->ssid, ssid->ssid_len); - ssids_local[ssid_cnt].SSID_len = ssid->ssid_len; + ssids_local[ssid_cnt].SSID_len = MIN(ssid->ssid_len, + (uint32)DOT11_MAX_SSID_LEN); + memcpy(ssids_local[ssid_cnt].SSID, ssid->ssid, + ssids_local[ssid_cnt].SSID_len); if (is_ssid_in_list(ssid, hidden_ssid_list, request->n_ssids)) { ssids_local[ssid_cnt].hidden = TRUE; WL_PNO((">>> PNO hidden SSID (%s) \n", ssid->ssid)); @@ -11800,8 +11810,8 @@ wl_update_prof(struct bcm_cfg80211 *cfg, struct net_device *ndev, ssid = (wlc_ssid_t *) data; memset(profile->ssid.SSID, 0, sizeof(profile->ssid.SSID)); - memcpy(profile->ssid.SSID, ssid->SSID, ssid->SSID_len); - profile->ssid.SSID_len = ssid->SSID_len; + profile->ssid.SSID_len = MIN(ssid->SSID_len, (uint32)DOT11_MAX_SSID_LEN); + memcpy(profile->ssid.SSID, ssid->SSID, profile->ssid.SSID_len); break; case WL_PROF_BSSID: if (data) @@ -11884,27 +11894,43 @@ static __used s32 wl_add_ie(struct bcm_cfg80211 *cfg, u8 t, u8 l, u8 *v) static void wl_update_hidden_ap_ie(struct wl_bss_info *bi, u8 *ie_stream, u32 *ie_size, bool roam) { u8 *ssidie; + int32 ssid_len = MIN((int)bi->SSID_len, DOT11_MAX_SSID_LEN); + int32 remaining_ie_buf_len, available_buffer_len; ssidie = (u8 *)cfg80211_find_ie(WLAN_EID_SSID, ie_stream, *ie_size); + + /* + * ERROR out if + * 1. No ssid IE is FOUND or + * 2. New ssid length is > what was allocated for existing ssid (as + * we do not want to overwrite the rest of the IEs) or + * 3. If in case of erroneous buffer input where ssid length doesnt match the space + * allocated to it. + */ if (!ssidie) return; - if (ssidie[1] != bi->SSID_len) { + + available_buffer_len = ((int)(*ie_size)) - (ssidie + 2 - ie_stream); + remaining_ie_buf_len = available_buffer_len - (int)ssidie[1]; + if ((ssid_len > ssidie[1]) || (ssidie[1] > available_buffer_len)) + return; + + if (ssidie[1] != ssid_len) { if (ssidie[1]) { WL_ERR(("%s: Wrong SSID len: %d != %d\n", __FUNCTION__, ssidie[1], bi->SSID_len)); } if (roam) { WL_ERR(("Changing the SSID Info.\n")); - memmove(ssidie + bi->SSID_len + 2, - (ssidie + 2) + ssidie[1], - *ie_size - (ssidie + 2 + ssidie[1] - ie_stream)); - memcpy(ssidie + 2, bi->SSID, bi->SSID_len); - *ie_size = *ie_size + bi->SSID_len - ssidie[1]; - ssidie[1] = bi->SSID_len; + memmove(ssidie + ssid_len + 2, + (ssidie + 2) + ssidie[1], remaining_ie_buf_len); + memcpy(ssidie + 2, bi->SSID, ssid_len); + *ie_size = *ie_size + ssid_len - ssidie[1]; + ssidie[1] = ssid_len; } return; } if (*(ssidie + 2) == '\0') - memcpy(ssidie + 2, bi->SSID, bi->SSID_len); + memcpy(ssidie + 2, bi->SSID, ssid_len); return; } |