wlan: Fix OOB read in lim_process_deauth_frame
In the API lim_process_deauth_frame, the reason-code is
fetched from the payload, and it may happen that the
payload received is empty, and the MPDU just contains the
header, so the driver may access the memory not allocated
to the frame, thus resulting in a OOB read.
Fix is to have a min length check of 16 bits for the
reason code before accessing it.
Issue: SEC-1892
Change-Id: I471198582bd7d40dee45d88b76ce6231456dc5ce
CRs-Fixed: 2249768
Signed-off-by: Gururaj Patil <gururaj.patil3@harman.com>
1 file changed