Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[lineage-17.1] Android Security Bulletin 2020-08 #3

Merged
merged 2 commits into from
Aug 4, 2020
Merged

[lineage-17.1] Android Security Bulletin 2020-08 #3

merged 2 commits into from
Aug 4, 2020

Commits on Aug 3, 2020

  1. qcacld-3.0: Validate assoc response IE len before copy 

    When host sends ft assoc response to supplicant, it
allocates a buffer of fixed size and copies a variable
length of assoc response IEs to this fixed sized buffer.
There is a possibility of OOB write to the allocated buffer
if the assoc response IEs length is greater than the
allocated buffer size.

To avoid above issue validate the assoc response IEs length
with the allocated buffer size before data copy to the buffer.

Change-ID: Ife9c2071a8cc4a2918b9f349f4024478f94b2d78
CRs-Fixed: 2575144
    @derfelot
    Ashish Kumar Dhanotiya authored and derfelot committed Aug 3, 2020
    Configuration menu
    Copy the full SHA
    c154a39 View commit details
    Browse the repository at this point in the history

  2. qcacld-3.0: Fix while condition in rrm_fill_beacon_ies() 

    In function rrm_fill_beacon_ies, do while loop is checked
for BcnNumIes if it is greater than IE length 0. Fix the
check to be greater than 2 as the first two bytes is IE
header(element ID and IE length fields both 1 byte each.)

Change-Id: I11e5de481cd49a22acafee938fbe73f839f5b0e4
CRs-Fixed: 2626729
    @derfelot
    Gururaj Pandurangi authored and derfelot committed Aug 3, 2020
    Configuration menu
    Copy the full SHA
    23f3ae5 View commit details
    Browse the repository at this point in the history