Deeksha Gupta 3d3d3c4fdb qcacmn: Validate next_ie length in util_get_successorfrag()
Currently, in wlan_defrag_elemsubelem_fragseq() API,
there is possible buffer over-read in fragbuff buffer.
Buffer may have a malicious length larger than their
payload size, which leads to a buffer over-read during
defragmentation.

Fix is to validate the fragment length against the buffer
boundary in util_get_successorfrag().

Change-Id: Ia9e688a0ab17954eb464ec586820bb95b51f12d1
CRs-Fixed: 3236560
2022-07-19 01:36:02 -07:00
2022-07-13 02:37:14 -07:00
2021-05-28 03:47:12 -07:00
2017-09-15 21:45:35 +05:30
2017-03-27 08:31:31 -07:00

 This is CNSS WLAN Host Driver for products starting from iHelium  
Description
No description provided
Readme 226 MiB
Languages
C 98.7%
C++ 0.9%
Makefile 0.3%
Starlark 0.1%