prima: Fix OOB read in limProcessDeauthFrame
Propagation from cld3.0 to cld2.0
Further adapted from cld2.0 to prima.
In the API limProcessDeauthFrame, the reason-code is
fetched from the payload, and it may happen that the
payload received is empty, and the MPDU just contains the
header, so the driver may access the memory not allocated
to the frame, thus resulting in a OOB read.
Fix is to have a min length check of 16 bits for the
reason code before accessing it.
Issue: SEC-1892
Bug: 78528839
Test: Test with provided PoC (before and after the fix)
Change-Id: I7e7a435ba049356c13fb10240f4abb9bf6219af4
CRs-Fixed: 2338742
Signed-off-by: Sunil Ravi <sunilravi@google.com>
(adapted from commit 1bfa0f6cb01a34c56c572ff5b45f48bfe7adaade)
1 file changed