diff options
| author | Phil Turnbull <philipturnbull@github.com> | 2022-11-23 10:35:40 -0500 |
|---|---|---|
| committer | Kalle Valo <kvalo@kernel.org> | 2022-11-24 18:11:23 +0200 |
| commit | cd21d99e595ec1d8721e1058dcdd4f1f7de1d793 (patch) | |
| tree | 1b5646c0886c31bfe9a45f0e948acf4ad982bf9e | |
| parent | 2d0b08c157434eebf0b6393c570089666dacf2aa (diff) | |
| download | linux-cd21d99e595ec1d8721e1058dcdd4f1f7de1d793.tar.gz | |
wifi: wilc1000: validate pairwise and authentication suite offsets
There is no validation of 'offset' which can trigger an out-of-bounds
read when extracting RSN capabilities.
Signed-off-by: Phil Turnbull <philipturnbull@github.com>
Tested-by: Ajay Kathat <ajay.kathat@microchip.com>
Acked-by: Ajay Kathat <ajay.kathat@microchip.com>
Signed-off-by: Kalle Valo <kvalo@kernel.org>
Link: https://lore.kernel.org/r/20221123153543.8568-2-philipturnbull@github.com
| -rw-r--r-- | drivers/net/wireless/microchip/wilc1000/hif.c | 21 |
1 files changed, 16 insertions, 5 deletions
diff --git a/drivers/net/wireless/microchip/wilc1000/hif.c b/drivers/net/wireless/microchip/wilc1000/hif.c index eb1d1ba3a443..67df8221b5ae 100644 --- a/drivers/net/wireless/microchip/wilc1000/hif.c +++ b/drivers/net/wireless/microchip/wilc1000/hif.c @@ -482,14 +482,25 @@ void *wilc_parse_join_bss_param(struct cfg80211_bss *bss, rsn_ie = cfg80211_find_ie(WLAN_EID_RSN, ies->data, ies->len); if (rsn_ie) { + int rsn_ie_len = sizeof(struct element) + rsn_ie[1]; int offset = 8; - param->mode_802_11i = 2; - param->rsn_found = true; /* extract RSN capabilities */ - offset += (rsn_ie[offset] * 4) + 2; - offset += (rsn_ie[offset] * 4) + 2; - memcpy(param->rsn_cap, &rsn_ie[offset], 2); + if (offset < rsn_ie_len) { + /* skip over pairwise suites */ + offset += (rsn_ie[offset] * 4) + 2; + + if (offset < rsn_ie_len) { + /* skip over authentication suites */ + offset += (rsn_ie[offset] * 4) + 2; + + if (offset + 1 < rsn_ie_len) { + param->mode_802_11i = 2; + param->rsn_found = true; + memcpy(param->rsn_cap, &rsn_ie[offset], 2); + } + } + } } if (param->rsn_found) { |