commit 093c4faaf7937f5091676f6ea2a4ae6094332e38
author CNSS_WLAN Service <cnssbldsw@qualcomm.com> Fri May 31 08:29:43 2019 -0700
committer Gerrit - the friendly Code Review server <code-review@localhost> Fri May 31 08:29:43 2019 -0700
tree c33726e8f9259a4e335ade54839509c26dd238d0
parent 802082f8f6b3296941ab1091b267e511f007c6e5
parent 4aa58d58ab0a3c5a9110235d7fb4e51984f97a41

Merge "wlan: Fix possible integer underflow in cfg80211_rx_mgmt" into wlan-driver.lnx.1.0

CORE/HDD/src/wlan_hdd_main.c

diff --git a/CORE/HDD/src/wlan_hdd_main.c b/CORE/HDD/src/wlan_hdd_main.c
index 567bce5..94eac5c 100644
--- a/CORE/HDD/src/wlan_hdd_main.c
+++ b/CORE/HDD/src/wlan_hdd_main.c
@@ -15878,6 +15878,8 @@
    hdd_context_t *hdd_ctx = NULL;
    hdd_adapter_t *adapter = NULL;
    v_CONTEXT_t vos_context = NULL;
+   struct ieee80211_mgmt *mgmt =
+           (struct ieee80211_mgmt *)frame_ind->frameBuf;
 
    /* Get the global VOSS context.*/
    vos_context = vos_get_global_context(VOS_MODULE_ID_SYS, NULL);
@@ -15893,6 +15895,12 @@
    {
        return;
    }
+
+   if (frame_ind->frameLen < ieee80211_hdrlen(mgmt->frame_control)) {
+        hddLog(LOGE, FL(" Invalid frame length"));
+        return;
+   }
+
    adapter = hdd_get_adapter_by_sme_session_id(hdd_ctx,
                                           frame_ind->sessionId);