46e0a1354b
mpdu_bytes_array_len, mpdu_msdus_array_len, and msdu_bytes_array_len are used to calculate the record size, as well as used as buffer offset, without any verification. This can cause to multiple overflows and underflow leading to OOB reads. Add checks for each arithmetic operation with these variables. Change-Id: Ib6ec6ac6932eb8c541bc2357d45d3feaf39fdb7d CRs-Fixed: 2226125
This is CNSS WLAN Host Driver for products starting from iHelium