commit f3b9d7e9f2fd9b09108c268a33b2434836efb5ea
author Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> Tue Mar 10 01:48:35 2020 +0000
committer Automerger Merge Worker <android-build-automerger-merge-worker@system.gserviceaccount.com> Tue Mar 10 01:48:35 2020 +0000
tree 1d4b41fa17c48906cc6b40d0a64df3da2b1c892f
parent 198dc37464ae2ea3ad6707091cffdfe6b18e7d94
parent 027a922c95967a6ba3ddda8b522de963df16da19

qcwcn: Heap-buffer-overflow in register_monitor_sock() of wifi hal am: 0ed8dbf042 am: 027a922c95

Change-Id: I14bfe6aecddfe01626779ae8bd3a823e38af3465

qcwcn/wifi_hal/wifi_hal.cpp

diff --git a/qcwcn/wifi_hal/wifi_hal.cpp b/qcwcn/wifi_hal/wifi_hal.cpp
index 2a6a9e9..4576063 100644
--- a/qcwcn/wifi_hal/wifi_hal.cpp
+++ b/qcwcn/wifi_hal/wifi_hal.cpp
@@ -1291,6 +1291,12 @@
 
     if(attach)
     {
+       if (ctrl_msg->monsock_len > sizeof(struct sockaddr_un))
+       {
+         ALOGE("%s: Invalid monitor socket length \n", __FUNCTION__);
+         return -3;
+       }
+
        nreg = (wifihal_mon_sock_t *)malloc(sizeof(*reg) + match_len);
         if (!nreg)
            return -1;