[PATCH 07/16] PR: Fix a possible buffer overflow in struct pr_channels

[Peddolla Harshavardhan Reddy]

Avoid adding more than PR_MAX_OP_CLASSES operating classes while
parsing a channel list from a peer. The current code does not check
the limit before writing into the op_class array, so a peer sending
more operating classes than PR_MAX_OP_CLASSES could trigger an
buffer overflow.

Break out of the loop once PR_MAX_OP_CLASSES entries have been
collected to enforce the limit. Adjust the post-loop count mismatch
check to treat truncation as valid so that a peer advertising more
classes than the local limit is accepted rather than rejected.

Fixes: 91c6940c2024 ("PR: Process EDCA Capability Attribute from USD PR element")
Signed-off-by: Peddolla Harshavardhan Reddy <peddolla.reddy at oss.qualcomm.com>
---
 src/common/proximity_ranging.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/src/common/proximity_ranging.c b/src/common/proximity_ranging.c
index 19261c3ee..ae31d0fb8 100644
--- a/src/common/proximity_ranging.c
+++ b/src/common/proximity_ranging.c
@@ -1008,9 +1008,12 @@ static int pr_process_channels(const u8 *channel_list, size_t channel_list_len,
 		os_memcpy(cl->channel, pos, cl->channels);
 		pos += channels;
 		ch->op_classes++;
+		if (ch->op_classes == PR_MAX_OP_CLASSES)
+			break;
 	}
 
-	if (ch->op_classes != op_class_count) {
+	if (ch->op_classes != op_class_count &&
+	    ch->op_classes < PR_MAX_OP_CLASSES) {
 		wpa_printf(MSG_INFO,
 			   "PR: Channel list count mismatch %lu != %d",
 			   ch->op_classes, op_class_count);
-- 
2.34.1