commit 17a101dc4db673a6ae2963670c449395343d9d41
author Dennis Jeon <dennis.jeon@broadcom.corp-partner.google.com> Thu Dec 29 07:20:26 2022 +0000
committer Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> Thu Dec 29 07:20:26 2022 +0000
tree 6fc080ec86699d17ee4fecbcc5795db654332a01
parent 5b99260608bdda7e9f598ad50580e4cca58cdfc6
parent 15500502b794953e025f7543b3bb1b0ed5aecf87

Fix OOB write possible when len equals sizeof array am: 15500502b7

Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/broadcom/wlan/+/20770980

Change-Id: I6b5019300ef3be58c9108858572a53f01a23148e
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

bcmdhd/wifi_hal/nan.cpp

diff --git a/bcmdhd/wifi_hal/nan.cpp b/bcmdhd/wifi_hal/nan.cpp
index bfc33e0..b25a41e 100755
--- a/bcmdhd/wifi_hal/nan.cpp
+++ b/bcmdhd/wifi_hal/nan.cpp
@@ -1386,6 +1386,8 @@
         }
 
         if (mParams->service_specific_info_len > 0) {
+            u16 len = min(mParams->service_specific_info_len,
+                          sizeof(mParams->service_specific_info) - 1);
             result = request.put_u16(NAN_ATTRIBUTE_SERVICE_SPECIFIC_INFO_LEN,
                     mParams->service_specific_info_len);
             if (result < 0) {
@@ -1400,7 +1402,7 @@
                 ALOGE("%s: Failed to put svc info, result = %d", __func__, result);
                 return result;
             }
-            mParams->service_specific_info[mParams->service_specific_info_len] = '\0';
+            mParams->service_specific_info[len] = '\0';
             ALOGI("Transmit service info string is %s\n", mParams->service_specific_info);
         }