tree 71d14f9a67c36e16aca9b69b5ae73d830eaa1430
parent 186f0ba1608c52b52db31a159dbc8e29eb36f98c
author Pragaspathi Thilagaraj <tpragasp@codeaurora.org> 1581503858 +0530
committer Pragaspathi Thilagaraj <tpragasp@codeaurora.org> 1582274756 +0530

wlan: Fix integer overflow in rrm_fill_beacon_ies()

In function rrm_fill_beacon_ies, the total IE length is
calculated as sum of length field of the IE and 2 (element id 1
byte and IE length field 1 byte). The total IE length is defined
of type uint16_t and will overflow if the *(pBcnIes + 1)=0xfe.
Validate the len against total IE length to avoid overflow.

Change-Id: If8f86952ce43c5923906fc6ef18705f1785c5d88
CRs-Fixed: 2617004