commit ef56977e0830a47472154d95fff06dd25fba09db
author Dennis Jeon <dennis.jeon@broadcom.corp-partner.google.com> Thu Dec 29 07:20:28 2022 +0000
committer Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> Thu Dec 29 07:20:28 2022 +0000
tree 243517df15a8a58b0067f4026a57087cfd2ebade
parent 17a101dc4db673a6ae2963670c449395343d9d41
parent a8bfe75958bca32db6f3dbe534a66cfd168c4f8a

Fixed OOB read/write possible when len equals sizeof array am: a8bfe75958

Original change: https://googleplex-android-review.googlesource.com/c/platform/hardware/broadcom/wlan/+/20800788

Change-Id: I68a68c32357a35a6e56a45e061a3bf1aa66bbb8b
Signed-off-by: Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com>

bcmdhd/wifi_hal/nan.cpp

diff --git a/bcmdhd/wifi_hal/nan.cpp b/bcmdhd/wifi_hal/nan.cpp
index b25a41e..a2d2d47 100755
--- a/bcmdhd/wifi_hal/nan.cpp
+++ b/bcmdhd/wifi_hal/nan.cpp
@@ -702,6 +702,8 @@
 
         if (mParams->service_name_len) {
             u8 svc_hash[NAN_SVC_HASH_SIZE];
+            u16 len = min(mParams->service_name_len, sizeof(mParams->service_name) - 1);
+            mParams->service_name[len] = '\0';
 
             result = get_svc_hash(mParams->service_name, mParams->service_name_len,
                     svc_hash, NAN_SVC_HASH_SIZE);
@@ -1066,6 +1068,8 @@
 
         if (mParams->service_name_len) {
             u8 svc_hash[NAN_SVC_HASH_SIZE];
+            u16 len = min(mParams->service_name_len, sizeof(mParams->service_name) - 1);
+            mParams->service_name[len] = '\0';
 
             result = get_svc_hash(mParams->service_name, mParams->service_name_len,
                     svc_hash, NAN_SVC_HASH_SIZE);
@@ -5429,6 +5433,9 @@
 #endif /* CONFIG_BRCM */
     counters.dp_req++;
     if (msg->service_name_len) {
+        u16 len = min(msg->service_name_len, sizeof(msg->service_name) - 1);
+        msg->service_name[len] = '\0';
+
         if (strncmp(NAN_OOB_INTEROP_SVC_NAME,
                     (char*)msg->service_name, msg->service_name_len) == 0) {
             ALOGI("Use Hardcoded svc_hash\n");
@@ -5514,6 +5521,9 @@
 #endif /* CONFIG_BRCM */
     counters.dp_resp++;
     if (msg->service_name_len) {
+        u16 len = min(msg->service_name_len, sizeof(msg->service_name) - 1);
+        msg->service_name[len] = '\0';
+
         if (strncmp(NAN_OOB_INTEROP_SVC_NAME,
                     (char*)msg->service_name, msg->service_name_len) == 0) {
             ALOGI("Use Hardcoded svc_hash\n");