diff mbox series

[1/4] wifi: wilc1000: validate pairwise and authentication suite offsets

Message ID 20221123153543.8568-2-philipturnbull@github.com
State New
Headers show
Series wilc1000: Improve RSN and attribute parsing | expand

Commit Message

Phil Turnbull Nov. 23, 2022, 3:35 p.m. UTC 
There is no validation of 'offset' which can trigger an out-of-bounds
read when extracting RSN capabilities.

Signed-off-by: Phil Turnbull <philipturnbull@github.com>
Tested-by: Ajay Kathat <ajay.kathat@microchip.com>
Acked-by: Ajay Kathat <ajay.kathat@microchip.com>
---
 drivers/net/wireless/microchip/wilc1000/hif.c | 21 ++++++++++++++-----
 1 file changed, 16 insertions(+), 5 deletions(-)

Comments

Kalle Valo Nov. 24, 2022, 4:11 p.m. UTC | #1 
Phil Turnbull <philipturnbull@github.com> wrote:

> There is no validation of 'offset' which can trigger an out-of-bounds
> read when extracting RSN capabilities.
> 
> Signed-off-by: Phil Turnbull <philipturnbull@github.com>
> Tested-by: Ajay Kathat <ajay.kathat@microchip.com>
> Acked-by: Ajay Kathat <ajay.kathat@microchip.com>

4 patches applied to wireless.git, thanks.

cd21d99e595e wifi: wilc1000: validate pairwise and authentication suite offsets
051ae669e450 wifi: wilc1000: validate length of IEEE80211_P2P_ATTR_OPER_CHANNEL attribute
f9b62f9843c7 wifi: wilc1000: validate length of IEEE80211_P2P_ATTR_CHANNEL_LIST attribute
0cdfa9e6f091 wifi: wilc1000: validate number of channels
diff mbox series

Patch

diff --git a/drivers/net/wireless/microchip/wilc1000/hif.c b/drivers/net/wireless/microchip/wilc1000/hif.c
index eb1d1ba3a443..67df8221b5ae 100644
--- a/drivers/net/wireless/microchip/wilc1000/hif.c
+++ b/drivers/net/wireless/microchip/wilc1000/hif.c
@@ -482,14 +482,25 @@  void *wilc_parse_join_bss_param(struct cfg80211_bss *bss,
 
 	rsn_ie = cfg80211_find_ie(WLAN_EID_RSN, ies->data, ies->len);
 	if (rsn_ie) {
+		int rsn_ie_len = sizeof(struct element) + rsn_ie[1];
 		int offset = 8;
 
-		param->mode_802_11i = 2;
-		param->rsn_found = true;
 		/* extract RSN capabilities */
-		offset += (rsn_ie[offset] * 4) + 2;
-		offset += (rsn_ie[offset] * 4) + 2;
-		memcpy(param->rsn_cap, &rsn_ie[offset], 2);
+		if (offset < rsn_ie_len) {
+			/* skip over pairwise suites */
+			offset += (rsn_ie[offset] * 4) + 2;
+
+			if (offset < rsn_ie_len) {
+				/* skip over authentication suites */
+				offset += (rsn_ie[offset] * 4) + 2;
+
+				if (offset + 1 < rsn_ie_len) {
+					param->mode_802_11i = 2;
+					param->rsn_found = true;
+					memcpy(param->rsn_cap, &rsn_ie[offset], 2);
+				}
+			}
+		}
 	}
 
 	if (param->rsn_found) {