tree 73ebc8652ea9ce2601f5be3b3ed10a77b20414b4
parent 1a48b52db5b37146fb15cfbda49f3be736061268
author Srinivas Girigowda <sgirigow@codeaurora.org> 1487318939 +0800
committer Silence.Zhang <Silence.Zhang@hi-p.com> 1487318967 +0800

FPII-2838: Information disclosure vulnerability in Qualcomm Wi-Fi driver (device specific) CVE-2017-0461A-32073794 QC-CR#1100132

qcacld-2.0: Fix array out-of-bounds & integer underflow in _iw_set_genie
'wrqu->data.length' holds the total number of IE data buffer.
Add a check to make sure the number of remaining data to be read is
greater than or equal to IE length.
Also, advance the buffer pointer to point to the next element only
if next element is present.

Change-Id: Iacd98fd53a905a075759db84537e2c8888dab6b6