c9f9272c69
During beacon or probe response, if channel is dfs && frame type is MGMT_SUBTYPE_BEACON, it would call "util_scan_add_hidden_ssid" to deal with the packet. If the ie id matches with SSID then OOB read may occur in ie_len as it is validated with upper bound of ie_ssid. Validate the ie length first. If it is more than 0 then copy memory to SSID which are equivalent to ie length. Change-Id: Ib5e2ab7f6f3337d4c3e5c240e3133d8f276be50a CRs-Fixed: 3007473
This is CNSS WLAN Host Driver for products starting from iHelium