
In function wlan_cfg80211_tdls_extract_6ghz_params(), the length of req_info->he_6ghz_cap is two bytes, but with a copy length of the length of pointer params->he_6ghz_capa. Make sure the righ copy length is used here to avoid OOB. Change-Id: I8e98c2a72ab032c3da9e0e213d1ea85f0653e0cb CRs-Fixed: 3047149