[1/1] UBUNTU: SAUCE: rtlwifi: rtl8822b: Fix potential overflow on P2P code
diff mbox series

Message ID 20191018071334.32244-2-tyhicks@canonical.com
State New
Headers show
Series
  • CVE-2019-17666: rtl8822b buffer overflow
Related show

Commit Message

Tyler Hicks Oct. 18, 2019, 7:13 a.m. UTC
Nicolas Waisman noticed that even though noa_len is checked for
a compatible length it's still possible to overrun the buffers
of p2pinfo since there's no check on the upper bound of noa_num.
Bounds check noa_num against P2P_MAX_NOA_NUM using the minimum of the
two.

CVE-2019-17666

Reported-by: Nicolas Waisman <nico@semmle.com>
Suggested-by: Ping-Ke Shih <pkshih@realtek.com>
[tyhicks: Reuse nearly all of a commit message written by Laura Abbott]
Signed-off-by: Tyler Hicks <tyhicks@canonical.com>
---
 drivers/staging/rtlwifi/ps.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

Comments

Kleber Souza Oct. 18, 2019, 9:56 a.m. UTC | #1
On 18.10.19 09:13, Tyler Hicks wrote:
> Nicolas Waisman noticed that even though noa_len is checked for
> a compatible length it's still possible to overrun the buffers
> of p2pinfo since there's no check on the upper bound of noa_num.
> Bounds check noa_num against P2P_MAX_NOA_NUM using the minimum of the
> two.
> 
> CVE-2019-17666
> 
> Reported-by: Nicolas Waisman <nico@semmle.com>
> Suggested-by: Ping-Ke Shih <pkshih@realtek.com>
> [tyhicks: Reuse nearly all of a commit message written by Laura Abbott]
> Signed-off-by: Tyler Hicks <tyhicks@canonical.com>

Acked-by: Kleber Sacilotto de Souza <kleber.souza@canonical.com>

> ---
>  drivers/staging/rtlwifi/ps.c | 4 ++--
>  1 file changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/drivers/staging/rtlwifi/ps.c b/drivers/staging/rtlwifi/ps.c
> index 7856fc5d10bd..11d1d497e3a5 100644
> --- a/drivers/staging/rtlwifi/ps.c
> +++ b/drivers/staging/rtlwifi/ps.c
> @@ -768,7 +768,7 @@ static void rtl_p2p_noa_ie(struct ieee80211_hw *hw, void *data,
>  					 noa_len);
>  				return;
>  			}
> -			noa_num = (noa_len - 2) / 13;
> +			noa_num = min((noa_len - 2) / 13, P2P_MAX_NOA_NUM);
>  			noa_index = ie[3];
>  			if (rtlpriv->psc.p2p_ps_info.p2p_ps_mode ==
>  			    P2P_PS_NONE || noa_index != p2pinfo->noa_index) {
> @@ -861,7 +861,7 @@ static void rtl_p2p_action_ie(struct ieee80211_hw *hw, void *data,
>  					 noa_len);
>  				return;
>  			}
> -			noa_num = (noa_len - 2) / 13;
> +			noa_num = min((noa_len - 2) / 13, P2P_MAX_NOA_NUM);
>  			noa_index = ie[3];
>  			if (rtlpriv->psc.p2p_ps_info.p2p_ps_mode ==
>  			    P2P_PS_NONE || noa_index != p2pinfo->noa_index) {
>

Patch
diff mbox series

diff --git a/drivers/staging/rtlwifi/ps.c b/drivers/staging/rtlwifi/ps.c
index 7856fc5d10bd..11d1d497e3a5 100644
--- a/drivers/staging/rtlwifi/ps.c
+++ b/drivers/staging/rtlwifi/ps.c
@@ -768,7 +768,7 @@  static void rtl_p2p_noa_ie(struct ieee80211_hw *hw, void *data,
 					 noa_len);
 				return;
 			}
-			noa_num = (noa_len - 2) / 13;
+			noa_num = min((noa_len - 2) / 13, P2P_MAX_NOA_NUM);
 			noa_index = ie[3];
 			if (rtlpriv->psc.p2p_ps_info.p2p_ps_mode ==
 			    P2P_PS_NONE || noa_index != p2pinfo->noa_index) {
@@ -861,7 +861,7 @@  static void rtl_p2p_action_ie(struct ieee80211_hw *hw, void *data,
 					 noa_len);
 				return;
 			}
-			noa_num = (noa_len - 2) / 13;
+			noa_num = min((noa_len - 2) / 13, P2P_MAX_NOA_NUM);
 			noa_index = ie[3];
 			if (rtlpriv->psc.p2p_ps_info.p2p_ps_mode ==
 			    P2P_PS_NONE || noa_index != p2pinfo->noa_index) {