Fix length check and add sub_copy and length subie_len checks before accessing extn_elem to avoid any OOB read. Change-Id: I85ea636d5fe64e8508e91b06f0302d5f6258e583 CRs-Fixed: 3800831
@@ -3073,7 +3073,7 @@ static uint32_t util_gen_new_ie(struct wlan_objmgr_pdev *pdev,
if (extn_elem && extn_elem[TAG_LEN_POS] >= VALID_ELEM_LEAST_LEN) {
if (((extn_elem + extn_elem[1] + MIN_IE_LEN) - sub_copy)
- < subie_len)
+ <= subie_len)
util_parse_noninheritance_list(extn_elem, &elem_list,
&extn_elem_list, &ninh);
}