commit | 535a5f25261df8e9acca250504c8574f75e2ded9 | [log] [tgz] |
---|---|---|
author | Nachiket Kukade <nkukade@codeaurora.org> | Tue Jan 23 23:36:25 2018 +0530 |
committer | chrmhoffmann <chrmhoffmann@gmail.com> | Sun Jun 23 16:46:11 2019 +0200 |
tree | ebdff52de3d287a85c57ec2aa141a24e82dc1676 | |
parent | 52a2f0df708a92e040d62b22607b5d26002b85b0 [diff] |
wlan: Add maximum bound check on WPA RSN IE length In set_ie after receiving DOT11F_EID_RSN, WPA RSN IE is copied from source without a check on the given IE length. A malicious IE length can cause buffer overflow. Apply the same logic from Id159d307e8f9c1de720d4553a7c29f23cbd28571 that was applied under DOT11F_EID_WPA. This adds maximum bound check on WPA RSN IE length. Change-Id: I04f980fe44328b1a3f6a6d4854228cc4c9f1a1c7 CRs-Fixed: 2177210