Files
android_kernel_samsung_sm86…/core
Abhinav Kumar db3c6f57e3 qcacld-3.0: Fix out-of-bounds access in lim_process_assoc_req_frame
Currently the function lim_process_assoc_req_frame uses frame_len
without validation to parse the IE buffer which could lead to
out-of-bounds memory access if the frame_len is less than or
equal to LIM_ASSOC_REQ_IE_OFFSET(4).

Add check to validate the frame_len with LIM_ASSOC_REQ_IE_OFFSET
before sending (frame_len - LIM_ASSOC_REQ_IE_OFFSET) to
cfg_get_vendor_ie_ptr_from_oui to parse only the IE buffer.

Change-Id: Iaa9e8db4a2605169c9ad3904878a2e626eb6de8b
CRs-Fixed: 2259707
2018-06-25 14:12:45 -07:00
..
2018-06-25 04:55:52 -07:00
2018-06-21 22:42:15 -07:00