[PATCH] nl80211: verify frame length before reading auth_alg

[Andrei Otcheretianski]

From: Daniel Gabay <daniel.gabay at intel.com>

In mlme_event(), auth_alg is read from mgmt->u.auth.auth_alg when
len >= 24, but this field starts at offset 24 and is 2 bytes wide,
requiring len >= 26. A management frame with exactly 24 bytes (header
only, no body) triggers a 2-byte OOB heap read. Guard the access with
a proper length check.

Signed-off-by: Daniel Gabay <daniel.gabay at intel.com>
---
 src/drivers/driver_nl80211_event.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/src/drivers/driver_nl80211_event.c b/src/drivers/driver_nl80211_event.c
index 86f7372b59..116d102ec5 100644
--- a/src/drivers/driver_nl80211_event.c
+++ b/src/drivers/driver_nl80211_event.c
@@ -1907,7 +1907,8 @@ static void mlme_event(struct i802_bss *bss,
 		mgmt = (const struct ieee80211_mgmt *) data;
 		fc = le_to_host16(mgmt->frame_control);
 		stype = WLAN_FC_GET_STYPE(fc);
-		auth_type = le_to_host16(mgmt->u.auth.auth_alg);
+		if (len >= 24 + sizeof(mgmt->u.auth.auth_alg))
+			auth_type = le_to_host16(mgmt->u.auth.auth_alg);
 	}
 
 	if (cmd == NL80211_CMD_FRAME && stype == WLAN_FC_STYPE_AUTH &&
-- 
2.53.0