d47fccbfde
Currently, while parsing scan RNR Ie data is moved to next neighbor_ap_info_field after parsing the current neighbor_ap_info_field. But in last iteration pointer may try to access invalid data if (uint8_t *)ie + rnr_ie_len + 2) bytes are less than sizeof neighbor_ap_info_field and same is the case with tbtt_length access. Fix is to add a length check of data + next data size to be parsed < (uint8_t *)ie + rnr_ie_len + 2) instead of adding a validation of data length only. CRs-Fixed: 3710080 Change-Id: I05e5a9a02f0f4f9bc468db894588e676f0a248c0
This is CNSS WLAN Host Driver for products starting from iHelium