| commit | 17937822db29ed8381a23743a8e2da65a90d3a7f | [log] [tgz] |
|---|---|---|
| author | Pragaspathi Thilagaraj <tpragasp@codeaurora.org> | Wed Feb 12 16:07:38 2020 +0530 |
| committer | Pragaspathi Thilagaraj <tpragasp@codeaurora.org> | Fri Feb 21 14:15:56 2020 +0530 |
| tree | 71d14f9a67c36e16aca9b69b5ae73d830eaa1430 | |
| parent | 186f0ba1608c52b52db31a159dbc8e29eb36f98c [diff] |
wlan: Fix integer overflow in rrm_fill_beacon_ies() In function rrm_fill_beacon_ies, the total IE length is calculated as sum of length field of the IE and 2 (element id 1 byte and IE length field 1 byte). The total IE length is defined of type uint16_t and will overflow if the *(pBcnIes + 1)=0xfe. Validate the len against total IE length to avoid overflow. Change-Id: If8f86952ce43c5923906fc6ef18705f1785c5d88 CRs-Fixed: 2617004