| commit | de0cd2a5cb30e120e3e1cf12a3b88734464073d5 | [log] [tgz] |
|---|---|---|
| author | Gururaj Pandurangi <panduran@codeaurora.org> | Wed Oct 27 12:02:58 2021 -0700 |
| committer | Maarten Derks <maarten@fairphone.com> | Thu May 19 13:35:30 2022 +0200 |
| tree | 1eb68dbab3a4919bf23bd8605032a60f89b35723 | |
| parent | 5bc9e30d3b21f7e6936fe111ad9340904c9392c3 [diff] |
wlan: Avoid OOB read in dot11f_unpack_assoc_response Avoid OOB read in dot11f_unpack_assoc_response API. Modify the check to nBuf-len > 1 to read another byte of pBufRemaining. This ensures a read of at least 2 bytes since all IEs have at least 2 bytes. Issue: SEC-3386 Change-Id: If8f43739091b1baa8a86751fa60b9af2a90a751a CRs-Fixed: 3064612 (cherry picked from commit edc957bca2d254d202765b7fd131261ad2b75a29)