commit e7eb6dd04a94f2484c9642fc0f5ba45207b3cf4e
author Gururaj Patil <gururaj.patil3@harman.com> Fri Nov 22 06:52:17 2019 +0000
committer Maarten Derks <maarten@fairphone.com> Thu Nov 28 19:27:59 2019 +0000
tree ff5cb8c35d6b61eaa332584631c755663f01ce79
parent 78f904feb59adc334c8e78173162c86239c0c7f9

wlan: Fix possible integer underflow in cfg80211_rx_mgmt

In the function cfg80211_rx_mgmt, data_len is calculated as
len - ieee80211_hdrlen(mgmt->frame_control). Len is not
validated before this calculation. So a possible integer
underflow will occur if len value is less than the value of
ieee80211_hdrlen(mgmt->frame_control).

Validate the value of len against
ieee80211_hdrlen(mgmt->frame_control) in the caller.

Issue: SEC-1940
Change-Id: I321533d31ef040e869e0559a8449d0fd89b75305
CRs-Fixed: 2460252
Signed-off-by: Gururaj Patil <gururaj.patil3@harman.com>